Description
JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows authenticated users to read other users' records via the userId parameter. Low-privileged attackers can supply another user id to retrieve their AI video generation history, including prompts, task ids, video URLs and cover URLs.
Published: 2026-10-10
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Authorization Bypass
Action: Patch or Secure
AI Analysis

Impact

The vulnerability allows an authenticated user to read another user's AI video generation activity by passing an arbitrary userId to the /airag/video/listByUser endpoint. This can expose prompts, task IDs, video URLs, and cover URLs that belong to other users, constituting a privacy breach.

Affected Systems

JeecgBoot versions up to and including 3.9.5, specifically the VideoGenerationController in the airag module. The issue is present in releases prior to the patch that corrects the authorization check for the userId parameter.

Risk and Exploitability

A CVSS score of 5.3 indicates moderate risk. Exploit probability is not listed in EPSS and the vulnerability is not in the CISA KEV catalog, suggesting no widespread exploitation yet. The likely attack vector involves a legitimate authenticated HTTP request with a manipulated userId; no public exploit or payload is documented at this time.

Generated by OpenCVE AI on October 11, 2026 at 00:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade JeecgBoot to the latest release that resolves the authorization check issue.
  • If an upgrade is not immediately possible, modify the VideoGenerationController to enforce that the requested userId matches the authenticated user's ID, rejecting all other values.
  • As a temporary protection, disable or block access to the /airag/video/listByUser endpoint until a patch can be applied.
  • Continuously monitor authentication logs for repeated attempts to access video histories belonging to other users.

Generated by OpenCVE AI on October 11, 2026 at 00:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 11 Oct 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Jeecg jeecgboot
Vendors & Products Jeecg jeecgboot

Sat, 10 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
Description JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows authenticated users to read other users' records via the userId parameter. Low-privileged attackers can supply another user id to retrieve their AI video generation history, including prompts, task ids, video URLs and cover URLs.
Title JeecgBoot through 3.9.5 Authorization Bypass via /airag/video/listByUser
First Time appeared Jeecg
Jeecg jeecg Boot
Weaknesses CWE-639
CPEs cpe:2.3:a:jeecg:jeecg_boot:*:*:*:*:*:*:*:*
Vendors & Products Jeecg
Jeecg jeecg Boot
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Jeecg Jeecg Boot Jeecgboot
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-18T11:53:08.038Z

Reserved: 2026-10-10T20:19:33.732Z

Link: CVE-2026-108672

cve-icon Vulnrichment

Updated: 2026-10-18T11:47:38.152Z

cve-icon NVD

Status : Deferred

Published: 2026-10-10T22:16:44.063

Modified: 2026-10-18T12:16:59.503

Link: CVE-2026-108672

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-11T11:45:17Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key