CVE-2026-5616 Details
Description
A security vulnerability has been detected in JeecgBoot 3.9.0/3.9.1. The impacted element is an unknown function of the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/airag/JeecgBizToolsProvider.java of the component AI Chat Module. Such manipulation leads to missing authentication. The attack can be executed remotely. The name of the patch is b7c9aeba7aefda9e008ea8fe4fc3daf08d0c5b39/2c1cc88b8d983868df8c520a343d6ff4369d9e59. It is best practice to apply a patch to resolve this issue. The project fixed the issue with a commit which shall be part of the next official release.
A critical vulnerability exists in JeecgBoot versions 3.9.0 and 3.9.1 within the AI Chat module. The issue arises in the 'sendWithDefault()' method of the 'AiragChatServiceImpl' class, where sensitive business tools are loaded without verifying the user's authentication status. This flaw allows unauthenticated users to access tools that can create backdoor accounts with admin privileges, potentially leading to a full system takeover. The vulnerability is present in an endpoint designed for public use, but the lack of authentication checks for default application users creates a significant security risk.
A patch has been applied to add the necessary authentication checks before loading sensitive tools. This patch is included in the latest version of JeecgBoot.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 6, 2026CISA-ADP
Assessed Apr 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jeecgboot/JeecgBoot/ | [email protected] | Source CodeVendor |
| https://github.com/jeecgboot/JeecgBoot/commit/b7c9aeba7aefda9e008ea8fe4fc3daf08d0c5b39 | [email protected] | Source CodeVendor |
| https://github.com/jeecgboot/JeecgBoot/issues/9464 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/jeecgboot/JeecgBoot/pull/9463 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/submit/785570 | [email protected] | Technical Description |
| https://vuldb.com/vuln/355407 | [email protected] | AdvisoryRemedy |
| https://vuldb.com/vuln/355407/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| JeecgBoot | 3.9.0 (semver) 3.9.1 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 6, 2026 | New CVE Received | [email protected] |