Is CVE-2026-108665 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-108665?

CVE-2026-108665 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-108665

Description

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that allows any authenticated user to modify AI prompt templates. Low-privileged attackers can send PUT or POST requests to /airag/prompts/edit with a template id to overwrite prompt text and model parameters created by administrators or other users.