Cyber Posture

CVE-2026-5616

High

Published: 06 April 2026

Published
06 April 2026
Modified
27 April 2026
KEV Added
Patch
CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0013 31.3th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-5616 is a high-severity Improper Authentication (CWE-287) vulnerability. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as Other AI Platforms.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly addresses the missing authentication vulnerability by requiring definition and limitation of permitted actions without identification or authentication to prevent unauthorized remote manipulation of the affected function.

prevent

Enforces approved authorizations for access to system resources, mitigating the lack of authentication checks in the JeecgBizToolsProvider.java function.

prevent

Ensures timely remediation of the specific flaw through application of the provided patches, directly resolving the missing authentication issue.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Missing authentication in public-facing JeecgBoot web app (AI Chat Module) allows unauthenticated remote network exploitation with no privileges or interaction required, directly enabling T1190.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A security vulnerability has been detected in JeecgBoot 3.9.0/3.9.1. The impacted element is an unknown function of the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/airag/JeecgBizToolsProvider.java of the component AI Chat Module. Such manipulation leads to missing authentication. The attack can be executed remotely. The name…

more

of the patch is b7c9aeba7aefda9e008ea8fe4fc3daf08d0c5b39/2c1cc88b8d983868df8c520a343d6ff4369d9e59. It is best practice to apply a patch to resolve this issue. The project fixed the issue with a commit which shall be part of the next official release.

Deeper analysisAI

CVE-2026-5616 is a missing authentication vulnerability (CWE-287, CWE-306) in JeecgBoot versions 3.9.0 and 3.9.1. The flaw affects an unknown function in the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/airag/JeecgBizToolsProvider.java within the AI Chat Module.

The vulnerability enables remote exploitation over the network with low complexity, requiring no privileges or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, score 7.3 High). Attackers can manipulate the affected function without authentication, potentially achieving limited impacts on confidentiality, integrity, and availability.

Mitigation involves applying patches from commits b7c9aeba7aefda9e008ea8fe4fc3daf08d0c5b39 and 2c1cc88b8d983868df8c520a343d6ff4369d9e59, which resolve the issue and will be included in the next official JeecgBoot release. Relevant GitHub resources include the main repository, issue #9464, pull request #9463, and the specific patch commit.

Details

CWE(s)

AI Security AnalysisAI

AI Category
Other AI Platforms
Risk Domain
N/A
OWASP Top 10 for LLMs 2025
None mapped
Classification Reason
Matched keywords: ai

CVEs Like This One

CVE-2026-5320Shared CWE-287, CWE-306
CVE-2025-58443Shared CWE-287, CWE-306
CVE-2026-6577Shared CWE-287, CWE-306
CVE-2026-40344Shared CWE-287, CWE-306
CVE-2026-6582Shared CWE-287, CWE-306
CVE-2026-4562Shared CWE-287, CWE-306
CVE-2026-27595Shared CWE-306
CVE-2026-3053Shared CWE-287, CWE-306
CVE-2026-5000Shared CWE-287, CWE-306
CVE-2026-5632Shared CWE-287, CWE-306

References