Vulnerability · Published Oct 11, 2026 · Assigned by VulnCheck

CVE-2026-108879JeecgBoot through 3.9.5 IDOR via /airag/api/getChatVariable Username Parameter

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in JeecgBoot from jeecgboot. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 91.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability in AiragBaseApiController that allows authenticated users to read other users' AI chat variables via the username parameter. Attackers can send POST requests to /airag/api/getChatVariable with a target appId, username, and variable name to retrieve stored chat memory values from Redis.

Affected products (as reported)

Vendor	Product	Versions
jeecgboot	JeecgBoot	0 – through 3.9.5

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

Researcher Proof of Concept exploit
Vulnerable Code (v3.9.5) technical-description
VulnCheck Advisory: JeecgBoot through 3.9.5 IDOR via /airag/api/getChatVariable Username Parameter third-party-advisory