CVE-2026-5616

HighCVSS 7.3/10Last modified Jul 24, 2026

Description

A security vulnerability has been detected in JeecgBoot 3.9.0/3.9.1. The impacted element is an unknown function of the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/airag/JeecgBizToolsProvider.java of the component AI Chat Module. Such manipulation leads to missing authentication. The attack can be executed remotely. The name of the patch is b7c9aeba7aefda9e008ea8fe4fc3daf08d0c5b39/2c1cc88b8d983868df8c520a343d6ff4369d9e59. It is best practice to apply a patch to resolve this issue. The project fixed the issue with a commit which shall be part of the next official release.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-287 CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Apr 6, 2026
Last modified: Jul 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-561609.9Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network.CVE-2026-561619.6Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network.CVE-2026-5616210.0Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.CVE-2026-5616310.0Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges ove CVE-2026-561649.8Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a net CVE-2026-561659.8Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network.CVE-2026-561678.8Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a network.CVE-2026-561686.5Null pointer dereference in Windows SMB Server allows an authorized attacker to deny service over a network.CVE-2026-561698.8Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network.CVE-2026-56178.8The Login as User plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the CVE-2026-561707.5Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-561717.5Exposure of private personal information to an unauthorized actor in Windows RDP allows an unauthorized attacker to disclose information ove