Jeecgboot JeecgBoot vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Jeecgboot JeecgBoot: 102 record(s), with affected versions and fixes.
CVE-2026-108609
Medium · 4.3
CWE-639 Oct 10, 2026
JeecgBoot through 3.9.5 IDOR via /airag/voice/listByUser userId Parameter
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' AI voice generation history via the userId parameter of GET /airag/voice/listByUser. Attackers who know another user's id can retrieve submitted text-to-speech input, voice settings, timestamps, and generated audio file names and paths stored in Redis.
CVE-2026-58377
High · 8.1
CWE-862 Jun 30, 2026
JeecgBoot 3.9.2 - Missing Authorization on OpenAPI Credential Management Endpoints Exposes Access/Secret Keys
JeecgBoot through 3.9.2 contains a broken access control vulnerability that allows authenticated low-privilege users to perform full create, read, update, and delete operations on OpenAPI credentials by accessing the OpenApiAuthController and OpenApiPermissionController endpoints which lack Shiro authorization annotations. Attackers can exploit the unenforced access controls to list, add, edit, and delete all AK/SK credential pairs, with the list endpoint returning secret keys in plaintext, enabling credential theft and unauthorized invocation of the OpenAPI surface.