CVE-2026-108616 [MEDIUM] – JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtData

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController deleteBatch handler that allows any authenticated user to delete AI evaluator records. Low-privileged attackers can send comma-separated ids to DELETE /airag/extData/deleteBatch, which lacks owner or tenant checks, deleting other users’ evaluator and test-tracking records.