CVE-2026-108879
JeecgBoot through 3.9.5 IDOR via /airag/api/getChatVariable Username Parameter
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 11, 2026
- Updated
- Oct 18, 2026
- Reserved
- Oct 11, 2026
Description
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability in AiragBaseApiController that allows authenticated users to read other users' AI chat variables via the username parameter. Attackers can send POST requests to /airag/api/getChatVariable with a target appId, username, and variable name to retrieve stored chat memory values from Redis.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
JeecgBootjeecgboot |
|
References
- Researcher Proof of Conceptexploit
- Vulnerable Code (v3.9.5)technical-description
- VulnCheck Advisory: JeecgBoot through 3.9.5 IDOR via /airag/api/getChatVariable Username Parameterthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.