Advisories · Weakness

Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-108679 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusAnnouncement
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108678 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRoles
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108677 CVE record

CVSS 7.1 High

JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserByName
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108676 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/downLoadFiles
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108675 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/editIzTop
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108674 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /openapi/queryById
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108673 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/exportXls
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108672 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Authorization Bypass via /airag/video/listByUser
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108671 CVE record

CVSS 7.1 High

JeecgBoot through 3.9.5 Missing Authorization via /airag/airagMcp/queryById
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108670 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/experiment
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108669 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /airag/knowledge/embedding/search
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108668 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteRecycleBin
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108667 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/revertRecycleBin
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108666 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteBatch
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108665 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/edit
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108664 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/queryById
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108663 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteApply
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108662 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteTenantPackUser
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108661 CVE record

CVSS 7.1 High

JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/changeOwenUserTenant
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108660 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/updateApplyStatus
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108659 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/listPackByTenantUserId
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108658 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/queryTenantAuthInfo
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108657 CVE record

CVSS 8.6 High

JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/passApply
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108656 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via getTenantPackApplyUsers Endpoint
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108655 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/quartzJob/queryById
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108654 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/oss/file/queryById
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108653 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via GET /openapi/list
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108652 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/api/updateAvatar
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108651 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getRolesByUserId
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108650 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserPermissionSet
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108649 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRolesById
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108648 CVE record

CVSS 7.1 High

JeecgBoot through 3.9.5 Missing Authorization via getDynamicDbSourceByCode Endpoint
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108647 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/checkRule/importExcel
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108646 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/category/importExcel
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108645 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/category/edit
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108644 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/category/delete
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108643 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/category/deleteBatch
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108642 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 IDOR via PUT /sys/sysAnnouncementSend/edit
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108641 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 IDOR via /sys/sysAnnouncementSend/getOne
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108640 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/queryById
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108639 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/deletePhysic/{id}
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108638 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/user/deleteGroupUser
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108637 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via deleteUserGroupBatch Endpoint
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108636 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepart/appImportExcel
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108635 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via getDepartmentHead Endpoint
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108634 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission deleteBatch Endpoint
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108633 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/add
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108632 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission queryById Endpoint
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108631 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/delete
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108630 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/edit
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108629 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission datarule Endpoint
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108628 CVE record

CVSS 8.6 High

JeecgBoot through 3.9.5 Missing Authorization via saveDeptRolePermission Endpoint
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108627 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/role/datarule Endpoint
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108626 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via sysMessage queryById Endpoint
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108625 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via sysMessage Edit Endpoint
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108624 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via sysMessage deleteBatch Endpoint
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108623 CVE record

CVSS 7.1 High

JeecgBoot through 3.9.5 Missing Authorization via /sys/log/deleteBatch
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108622 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/log/delete Endpoint
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108621 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/position/edit
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-108620 CVE record

CVSS 5.3 Medium

JeecgBoot through 3.9.5 Missing Authorization via /sys/position/deleteBatch
- JeecgBoot
- Broken access control
Not analysed yet 10 Oct 2026