JeecgBoot's AI-RAG chat-variable endpoint accepts a caller-supplied username along with an application ID and variable name. In versions through 3.9.5, the published CVE-2026-108879 advisory describes an authorization gap: a logged-in user can nominate another account as the memory owner and request that account's stored variable from Redis. The handler's…
Inspect the ClaimsCase · DiggingBeagle record
JeecgBoot AI-RAG endpoint permits cross-user chat-variable reads
JeecgBoot CVE-2026-108879 concerns authenticated cross-user reads of AI-RAG chat variables. The getChatVariable route trusted a caller-supplied username instead of binding memory access to the logged-in account. Actual victims, variable sensitivity and a verified patch were not documented.
Scope
Controlled finding or reported disclosure as of 2026-10-11; Specific chat variables, not automatically all Redis keys or conversation histories.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade C
- AI role
- AGAINST AI
Basis and provenance
Desk review of scoped canonical Claims, the pinned SRC-2026-CP3-JEECG-AIRAG-CHAT-IDOR Source, and the publicly accessible primary disclosure. The classification applies to the documented setting and prerequisites only. Impact remains unbanded because real victim consequences are not established, and no independent reproduction is claimed. Details: No independently confirmed affected deployment, actual cross-user data theft or patch release was documented in the advisory.
Assessed Oct 13, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP3-JEECG-AIRAG-CHAT-IDOR-1 · CLM-CP3-JEECG-AIRAG-CHAT-IDOR-2 · CLM-CP3-JEECG-AIRAG-CHAT-IDOR-3 · JeecgBoot AI-RAG API reads other users Redis chat variables
At a glance
Agent chat memory needs authorization tied to the authenticated owner and application tenant. A client-provided username must not determine access to another person's memory, even when the API already requires login.
Read the implicationsNo independently confirmed affected deployment, actual cross-user data theft or patch release was documented in the advisory. Variable contents and exploitability under different tenant configurations remain unmeasured.
Limits and uncertaintyFull account
JeecgBoot's AI-RAG chat-variable endpoint accepts a caller-supplied username along with an application ID and variable name. In versions through 3.9.5, the published CVE-2026-108879 advisory describes an authorization gap: a logged-in user can nominate another account as the memory owner and request that account's stored variable from Redis. The handler's trust in the provided username is the boundary error, not a demonstrated ability to read arbitrary Redis keys.
The described request uses POST /airag/api/getChatVariable in AiragBaseApiController. An attacker still needs a valid authenticated session and values identifying the application, username and variable. The advisory establishes the vulnerable code path and a proof-of-concept reference but does not document actual victim access, the sensitivity of deployed variables or a tested patched release. Restricting authentication alone would not close an intra-user authorization flaw.
Mechanism and trust boundary
- 01
Authenticated request
A lower-privileged account sends a POST carrying a chosen appId, username and chat-variable name.
Boundary: A lower-privileged account sends a POST carrying a chosen appId, username and chat-variable name.
- 02
Ownership boundary
The AI-RAG handler uses the submitted username when selecting a Redis-backed memory variable without enforcing the logged-in caller as owner.
Boundary: The AI-RAG handler uses the submitted username when selecting a Redis-backed memory variable without enforcing the logged-in caller as owner.
- 03
Cross-user read
A variable associated with a different account can be returned; the advisory does not establish broader Redis access.
Boundary: A variable associated with a different account can be returned; the advisory does not establish broader Redis access.
Timeline
- Oct 11, 2026disclosure
Public disclosure
Claims & evidence
CLM-CP3-JEECG-AIRAG-CHAT-IDOR-1GitHub Advisory GHSA-5w4w-m38r-7r7r describes CVE-2026-108879 in JeecgBoot through 3.9.5: an authenticated user can read another userâs chat variable by controlling the username parameter.supported
Basis: reported finding
- supportsJeecgBoot AI-RAG API reads other users Redis chat variablessecondary reporting
Description, insecure direct object reference vulnerability
CLM-CP3-JEECG-AIRAG-CHAT-IDOR-2The documented route is /airag/api/getChatVariable in AiragBaseApiController, scoped to application, username and variable name inputs.supported
Basis: reported finding
- supportsJeecgBoot AI-RAG API reads other users Redis chat variablessecondary reporting
Description, endpoint and parameters
CLM-CP3-JEECG-AIRAG-CHAT-IDOR-3The October 11 GitHub Advisory lists no known patched version and describes CVE-2026-108879 as requiring an authenticated user who controls the username parameter in a getChatVariable request.supported
Basis: reported finding
- supportsJeecgBoot AI-RAG API reads other users Redis chat variablessecondary reporting
GHSA-5w4w-m38r-7r7r, Description, Affected versions and Patched versions
Implications
Agent chat memory needs authorization tied to the authenticated owner and application tenant. A client-provided username must not determine access to another person's memory, even when the API already requires login.
Controls and mitigations
- Derive or authorize the memory owner from the authenticated principal and bound tenant, not a caller-supplied username.
- Check appId and variable access against account ownership before any Redis lookup.
- Treat any remediation as unverified until a patched release and code-level authorization change are documented.
Unknowns and contradictions
- No independently confirmed affected deployment, actual cross-user data theft or patch release was documented in the advisory.
- Variable contents and exploitability under different tenant configurations remain unmeasured.
Sources and citation
Material revision history
- Oct 13, 2026 · Published version · first publication · revision 137