Tools AI Risk Radar ai-incident-0192
Incident record
JeecgBoot users can run other users’ prompt experiments
- Severity
- Medium
- Status
- Research
- Type
- Infra Vuln
- Target
- JeecgBoot through 3.9.5
- Actor
- researcher
- CVE
- CVE-2026-108670
What happened
An authenticated user with low privileges can run other users’ prompt experiments and access their prompt templates and datasets. The operation can also write experiment results and change dataset status.
The researcher’s code and CNA record were published on 10 October. Missing authorisation in the prompt-experiment handler crosses the dataset and template access boundary. The CNA gives CVSS 3.1 score 4.3. Patch status remains unconfirmed as of 11 October.
Sources
- CVE recordcveawg.mitre.org/api/cve/CVE-2026-108670
- Researcher disclosuregithub.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8…
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026