JeecgBoot AI-RAG applications expose configuration through queryById. The October 11, 2026 advisory for CVE-2026-108878 says that lower-privileged authenticated users could enumerate candidate application identifiers through /airag/app/listDict and retrieve configurations without passing ownership authorization at AiragAppController. Returned information…
Inspect the ClaimsCase · DiggingBeagle record
JeecgBoot AI application configuration was readable across users
JeecgBoot CVE-2026-108878 concerns cross-user AI application configuration disclosure. An authenticated caller could enumerate app IDs through listDict and retrieve prompts, model IDs and plugin bindings through queryById. The advisory does not prove access to the underlying documents or plugin execution.
Scope
Controlled finding or reported disclosure as of 2026-10-11; Config disclosure not proof underlying knowledge documents/credentials readable.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade C
- AI role
- AGAINST AI
Basis and provenance
Desk review of scoped canonical Claims, the pinned SRC-2026-CP3-JEECG-AIRAG-CONFIG-IDOR Source, and the publicly accessible primary disclosure. The classification applies to the documented setting and prerequisites only. Impact remains unbanded because real victim consequences are not established, and no independent reproduction is claimed. Details: No complete proof of downstream knowledge-document or credential access was published.
Assessed Oct 13, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP3-JEECG-AIRAG-CONFIG-IDOR-1 · CLM-CP3-JEECG-AIRAG-CONFIG-IDOR-2 · CLM-CP3-JEECG-AIRAG-CONFIG-IDOR-3 · JeecgBoot AI-RAG queryById leaks other users system prompts and plugin bindings
At a glance
Enumeration amplifies a direct-object-reference flaw because it supplies candidate IDs. Both list visibility and queryById authorization need owner and tenant checks, independently of whether other AI-RAG endpoints are protected.
Read the implicationsNo complete proof of downstream knowledge-document or credential access was published. The publicly reviewed advisory did not identify a patched release or confirmed exploited installations.
Limits and uncertaintyFull account
JeecgBoot AI-RAG applications expose configuration through queryById. The October 11, 2026 advisory for CVE-2026-108878 says that lower-privileged authenticated users could enumerate candidate application identifiers through /airag/app/listDict and retrieve configurations without passing ownership authorization at AiragAppController.
Returned information may include system and memory prompts, model IDs, knowledge-base IDs and plugin bindings from another user's application. Those identifiers can guide further investigation, but the advisory does not prove access to underlying knowledge-base documents, provider credentials or plugin execution. The two related JeecgBoot advisories concern different resources and endpoints: this configuration read is separate from the /airag/api/getChatVariable memory-owner flaw.
Mechanism and trust boundary
- 01
ID discovery
A logged-in caller enumerates AI application IDs through the exposed listDict route.
Boundary: A logged-in caller enumerates AI application IDs through the exposed listDict route.
- 02
Missing ownership check
A queryById request for an application owned by a different user is not rejected by the controller.
Boundary: A queryById request for an application owned by a different user is not rejected by the controller.
- 03
Configuration disclosure
The caller receives prompts, model or knowledge identifiers and plugin bindings; access to the referenced content or tools is a separate question.
Boundary: The caller receives prompts, model or knowledge identifiers and plugin bindings; access to the referenced content or tools is a separate question.
Timeline
- Oct 11, 2026disclosure
Public disclosure
Claims & evidence
CLM-CP3-JEECG-AIRAG-CONFIG-IDOR-1GitHub Advisory GHSA-mf5r-54hh-g48q documents CVE-2026-108878 affecting JeecgBoot through 3.9.5, with cross-user access to AI application settings via queryById.supported
Basis: reported finding
- supportsJeecgBoot AI-RAG queryById leaks other users system prompts and plugin bindingssecondary reporting
Description, missing authorization in AiragAppController
CLM-CP3-JEECG-AIRAG-CONFIG-IDOR-2According to the advisory, application IDs can be enumerated through /airag/app/listDict and used to retrieve prompts, model IDs, knowledge-base IDs and plugin bindings.supported
Basis: reported finding
- supportsJeecgBoot AI-RAG queryById leaks other users system prompts and plugin bindingssecondary reporting
Description, listDict enumeration and disclosed fields
CLM-CP3-JEECG-AIRAG-CONFIG-IDOR-3The October 11 GitHub Advisory describes an authenticated enumeration chain: /airag/app/listDict exposes candidate IDs and queryById returns another user's AI application configuration.supported
Basis: reported finding
- supportsJeecgBoot AI-RAG queryById leaks other users system prompts and plugin bindingssecondary reporting
GHSA-mf5r-54hh-g48q, Description
Implications
Enumeration amplifies a direct-object-reference flaw because it supplies candidate IDs. Both list visibility and queryById authorization need owner and tenant checks, independently of whether other AI-RAG endpoints are protected.
Controls and mitigations
- Enforce per-application ownership and tenant authorization inside queryById before returning configuration.
- Restrict listDict output as appropriate without relying on obscurity of IDs for access control.
- Verify patched authorization on both routes in a two-user test before treating the issue as fixed.
Unknowns and contradictions
- No complete proof of downstream knowledge-document or credential access was published.
- The publicly reviewed advisory did not identify a patched release or confirmed exploited installations.
Sources and citation
Material revision history
- Oct 13, 2026 · Published version · first publication · revision 137