Vulnerability Bulletins |
CVE-2026-108608 |
|
| Affected software | REDIS |
| JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice records by supplying an arbitrary userId to DELETE /airag/voice/deleteVoiceRecord. Attackers can obtain record ids from the unchecked GET /airag/voice/listByUser endpoint and delete victims' text-to-speech history entries stored in Redis, one per request. | |
Link: |
|
| https://nvd.nist.gov/vuln/detail/CVE-2026-108608 | |