PrivacyMedium
CVE-2026-108670: JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handl…
- Occurred
- Oct 10, 2026
- Published
- Oct 10, 2026
- Source
- NVD CVE
Summary
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handler of AiragPromptsController that allows any authenticated user to run AI prompt experiments. Low-privileged attackers can supply other users' prompt template and dataset ids to trigger large language model evaluation runs, write result rows into airag_ext_data, and change dataset status.
Tags
- CVE
- CVE-2026-108670
- cvss:MEDIUM
Classification
Category confidence: 85%
Severity confidence: 80%
Rationale: Unauthorized access to prompt experiments and data manipulation by low-privileged users constitutes a privacy and authorization breach.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8