CVE-2026-108608 — JeecgBoot through 3.9.5 IDOR via deleteVoiceRecord userId Parameter
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice records by supplying an arbitr…
Published: 2026-10-10 · CVSS: 5.3 · CVSS 4.0
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice records by supplying an arbitrary userId to DELETE /airag/voice/deleteVoiceRecord. Attackers can obtain record ids from the unchecked GET /airag/voice/listByUser endpoint and delete victims' text-to-speech history entries stored in Redis, one per request.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7