CVE-2026-108672

MediumCVSS 4.3/10Last modified Oct 18, 2026

Description

JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows authenticated users to read other users' records via the userId parameter. Low-privileged attackers can supply another user id to retrieve their AI video generation history, including prompts, task ids, video URLs and cover URLs.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

VendorProductVersions
jeecgbootJeecgBoot<= 3.9.5

References

Timeline

Published
Oct 10, 2026
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1086734.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController exportXls handler that allows any autheCVE-2026-1086744.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController queryById handler that allows low-privilegedCVE-2026-1086754.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-prCVE-2026-1086764.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows loCVE-2026-1086776.5JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticateCVE-2026-1086784.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenCVE-2026-1086794.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allowsCVE-2026-108689.0A mass assignment vulnerability exists in the MISP user edit functionality due to insufficient filtering of user-supplied fields in UsersConCVE-2026-1086804.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by CVE-2026-1086814.3A security flaw has been discovered in zhayujie CowAgent up to 2.1.7. Impacted is an unknown function of the file channel/web/web_channel.pyCVE-2026-1086825.4A weakness has been identified in zhayujie CowAgent up to 2.1.6. The affected element is the function read of the file /upload of the componCVE-2026-1086834.3A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function of the component Me
CVE-2026-108672: Medium severity, CVSS 4.3 | Vulnix