Description

A security vulnerability has been detected in JeecgBoot up to 3.9.3. This vulnerability affects the function exportXls of the file jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/llm/controller/AiragModelController.java. Such manipulation of the argument credential leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.9.5 is able to resolve this issue. The name of the patch is a2be896f753936956ee6863b632b8e5a0231345c. You should upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-06T23:17:38.990Z",
  "pubdate": "2026-09-06T23:17:38.990Z",
  "executiveSummary": "A critical improper access control vulnerability has been identified in JeecgBoot versions up to 3.9.3, specifically within the Airag module.\nThe vulnerability resides in the exportXls function of the AiragModelController, where improper handling of the credential argument allows unauthorized access to sensitive functionality.\nThis flaw enables remote attackers to exploit the system without requiring prior authentication, leading to potential data exposure or unauthorized operations.\nGiven that the exploit has been disclosed publicly, the risk of active exploitation is significant, necessitating immediate remedial action to protect system integrity.\nThe vulnerability impacts the confidentiality and integrity of the application, as it permits an attacker to manipulate sensitive parameters to bypass established access control mechanisms.\nOrganizations utilizing affected versions of JeecgBoot must prioritize patching to version 3.9.5 to mitigate this security risk.",
  "technicalDetails": "The vulnerability is situated within the file jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/llm/controller/AiragModelController.java, specifically affecting the exportXls function.\nThe root cause of this vulnerability is an improper implementation of access control checks concerning the 'credential' argument passed to the exportXls method. The application fails to adequately validate or sanitize this argument, allowing a remote attacker to manipulate the input to bypass intended authorization constraints.\nAttackers can leverage this flaw by sending a crafted request to the endpoint associated with AiragModelController. By manipulating the 'credential' parameter, an unauthorized user can force the application to perform export operations that are restricted to higher-privileged accounts or should otherwise be blocked.\nThe attack flow follows a direct-to-target model where the attacker probes the vulnerable controller for unprotected or insufficiently validated export functionality. By crafting specific HTTP requests containing malicious 'credential' payloads, the attacker effectively circumvents server-side security logic that is responsible for verifying user permissions prior to the execution of the export service.\nBecause the exposure occurs at the controller level, the application does not enforce the necessary security context required to restrict access to sensitive model data or configuration exports. Consequently, the impact includes unauthorized disclosure of information or the potential for an attacker to extract internal system data via the export interface.\nThis vulnerability is classified as remotely exploitable, requiring no specific local access or complex chain of prerequisites, making it a high-priority target for automated scanning and exploitation tools. The lack of robust validation in the function logic allows the input to dictate the execution path, overriding the standard authorization flow typically enforced by the JeecgBoot framework security interceptors."
}