Description
A security vulnerability has been detected in JeecgBoot up to 3.9.3. This vulnerability affects the function exportXls of the file jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/llm/controller/AiragModelController.java. Such manipulation of the argument credential leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.9.5 is able to resolve this issue. The name of the patch is a2be896f753936956ee6863b632b8e5a0231345c. You should upgrade the affected component.
Published: 2026-09-06
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the exportXls function of AiragModelController.java. By manipulating the credential argument, an attacker can bypass the controller’s authorization checks and download Excel reports intended for authorized users only. The resulting unauthorized data disclosure falls under Improper Privilege Management (CWE‑266) and Improper Access Control (CWE‑284). The flaw can be triggered remotely via crafted HTTP requests and has been publicly disclosed.

Affected Systems

Installed instances of JeecgBoot up to version 3.9.3 are vulnerable. The fix is available in release 3.9.5, delivered by commit a2be896f753936956ee6863b632b8e5a0231345c. Administrators should apply the upgrade to the JeecgBoot application or otherwise secure the AiragModelController module.

Risk and Exploitability

The CVSS score is 5.3, indicating medium severity, and no EPSS score is published. The vulnerability is not listed in the CISA KEV catalog. Because exploitation can be performed remotely by sending a crafted request to exportXls, the risk remains significant despite the moderate score. Prompt remediation is advised to prevent potential data leakage.

Generated by OpenCVE AI on September 6, 2026 at 23:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update JeecgBoot to version 3.9.5 or later to incorporate the patch for the exportXls access control flaw.
  • If an immediate upgrade is impossible, restrict access to the exportXls endpoint by enforcing HTTPS authentication and applying network controls such as IP whitelisting.
  • Apply role‑based permissions so that only users with appropriate privileges can invoke the exportXls function.
  • Continuously monitor application logs for unexpected calls to exportXls and investigate any anomalous activity.

Generated by OpenCVE AI on September 6, 2026 at 23:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 06 Sep 2026 22:45:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in JeecgBoot up to 3.9.3. This vulnerability affects the function exportXls of the file jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/llm/controller/AiragModelController.java. Such manipulation of the argument credential leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.9.5 is able to resolve this issue. The name of the patch is a2be896f753936956ee6863b632b8e5a0231345c. You should upgrade the affected component.
Title JeecgBoot AiragModelController.java exportXls access control
First Time appeared Jeecgboot
Jeecgboot jeecgboot
Weaknesses CWE-266
CWE-284
CPEs cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:*
Vendors & Products Jeecgboot
Jeecgboot jeecgboot
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Jeecgboot Jeecgboot
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-06T22:30:10.626Z

Reserved: 2026-09-06T04:13:03.167Z

Link: CVE-2026-86228

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-06T23:17:38.990

Modified: 2026-09-06T23:17:38.990

Link: CVE-2026-86228

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T00:00:06Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-284

    Improper Access Control