Vulnerabilidades do Jeecgboot JeecgBoot
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Jeecgboot JeecgBoot: 102 registro(s), com versões afetadas e correções.
CVE-2026-108609
Média · 4.3
CWE-639 10/10/2026
JeecgBoot through 3.9.5 IDOR via /airag/voice/listByUser userId Parameter
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' AI voice generation history via the userId parameter of GET /airag/voice/listByUser. Attackers who know another user's id can retrieve submitted text-to-speech input, voice settings, timestamps, and generated audio file names and paths stored in Redis.
CVE-2026-58377
Alta · 8.1
CWE-862 30/06/2026
JeecgBoot 3.9.2 - Missing Authorization on OpenAPI Credential Management Endpoints Exposes Access/Secret Keys
JeecgBoot through 3.9.2 contains a broken access control vulnerability that allows authenticated low-privilege users to perform full create, read, update, and delete operations on OpenAPI credentials by accessing the OpenApiAuthController and OpenApiPermissionController endpoints which lack Shiro authorization annotations. Attackers can exploit the unenforced access controls to list, add, edit, and delete all AK/SK credential pairs, with the list endpoint returning secret keys in plaintext, enabling credential theft and unauthorized invocation of the OpenAPI surface.