Pending AI Enrichment

This vulnerability was recently detected via the live feed and has not yet been processed by Precogs AI's context enrichment engine. The data below represents raw telemetric data.

RAW NVD TELEMETRY

CVE-2026-108672

CVSS Base Score
4.3 MEDIUM
Primary Weakness
CWE-639
Published Date
Oct 10, 2026
Data Source
NVD API

JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows authenticated users to read other users' records via the userId parameter. Low-privileged attackers can supply another user id to retrieve their AI video generation history, including prompts, task ids, video URLs and cover URLs.

Related Vulnerabilitiesvia CWE-639

CVE-2026-339316.5 MEDIUM

IDOR in OpenEMR Patient Portal payment page before 8.0.0.3. Authenticated patients can access other patients' payment and billing data (PHI) by manipulating the 'recid' parameter.

CWE-639
CVE-2026-339344.3 MEDIUM

IDOR in OpenEMR Patient Portal 'show-signature.php' before 8.0.0.3. Authenticated patients can retrieve staff member signature images by supplying arbitrary user values in the POST body.

CWE-639
CVE-2026-340558.1 HIGH

IDOR in OpenEMR library/pnotes.inc.php before 8.0.0.3. Legacy patient notes functions fail to verify ownership, allows users to access and manipulate notes of unauthorized patients.

CWE-639
CVE-2026-334250 UNKNOWN

Discourse is an open-source discussion platform.

CWE-203CWE-639CWE-862
CVE-2026-330538.8 HIGH

Langflow is a tool for building and deploying AI-powered agents and workflows.

CWE-639
CVE-2026-321140 UNKNOWN

Discourse is an open-source discussion platform.

CWE-639

Is your system affected?

Precogs AI detects CVE-2026-108672 in compiled binaries, LLMs, and application layers — even without source code access.

Request Deep AnalysisBook a demo