CVE-2026-5616
Published: 06 April 2026
Summary
CVE-2026-5616 is a medium-severity Improper Authentication (CWE-287) vulnerability. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as LLM Application Platforms; in the Other ATLAS/OWASP Terms risk domain.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-5616 is a missing authentication vulnerability (CWE-287, CWE-306) in JeecgBoot versions 3.9.0 and 3.9.1. The flaw affects an unknown function in the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/airag/JeecgBizToolsProvider.java within the AI Chat Module.
The vulnerability enables remote exploitation over the network with low complexity, requiring no privileges or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, score 7.3 High). Attackers can manipulate the affected function without authentication, potentially achieving limited impacts on confidentiality, integrity, and availability.
Mitigation involves applying patches from commits b7c9aeba7aefda9e008ea8fe4fc3daf08d0c5b39 and 2c1cc88b8d983868df8c520a343d6ff4369d9e59, which resolve the issue and will be included in the next official JeecgBoot release. Relevant GitHub resources include the main repository, issue #9464, pull request #9463, and the specific patch commit.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19162
Vulnerability details
A security vulnerability has been detected in JeecgBoot 3.9.0/3.9.1. The impacted element is an unknown function of the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/airag/JeecgBizToolsProvider.java of the component AI Chat Module. Such manipulation leads to missing authentication. The attack can be executed remotely. The name…
more
of the patch is b7c9aeba7aefda9e008ea8fe4fc3daf08d0c5b39/2c1cc88b8d983868df8c520a343d6ff4369d9e59. It is best practice to apply a patch to resolve this issue. The project fixed the issue with a commit which shall be part of the next official release.
- CWE(s)
AI Security AnalysisAI
- AI Category
- LLM Application Platforms
- Risk Domain
- Other ATLAS/OWASP Terms
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: ai
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authentication in public-facing JeecgBoot web app (AI Chat Module) allows unauthenticated remote network exploitation with no privileges or interaction required, directly enabling T1190.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the missing authentication vulnerability by requiring definition and limitation of permitted actions without identification or authentication to prevent unauthorized remote manipulation of the affected function.
Enforces approved authorizations for access to system resources, mitigating the lack of authentication checks in the JeecgBizToolsProvider.java function.
Ensures timely remediation of the specific flaw through application of the provided patches, directly resolving the missing authentication issue.