JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice… (CVE-2026-108608)

JeecgBoot through version 3.9.5 contains an insecure direct object reference vulnerability (CWE-639) in its AI voice record management API. Authenticated users can supply arbitrary userIds to the DELETE /airag/voice/deleteVoiceRecord endpoint to delete AI voice records of other users. The GET /airag/voice/listByUser endpoint does not enforce access controls, allowing attackers to enumerate record IDs. The affected records are stored in Redis, and each deletion requires a separate request. This vulnerability impacts the integrity of user data but does not affect confidentiality or availability.

An authenticated attacker can delete AI voice records of other users, resulting in loss of text-to-speech history data. There is no impact on confidentiality or availability. The integrity of user data is compromised due to unauthorized deletion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API endpoints to trusted users only and monitor for suspicious deletion activity. Implement proper authorization checks on userId parameters to ensure users can only delete their own records.