JeecgBoot through version 3.9.5 contains a missing authorization flaw in the SystemApiController updateAvatar handler. The flaw allows any authenticated user to issue a PUT request to /sys/api/updateAvatar with a target user ID and a new avatar URL, replacing administrators or other users’ avatars. This unauthorized modification can be used to impersonate a user or spread malicious images, thereby compromising user trust and potentially introducing phishing content.

Vulnerable deployments include the JeecgBoot application, all versions up to and including 3.9.5, as noted by the official CNA listing. The flaw was identified in the core API module of the system and applies to installations that expose the /sys/api/updateAvatar endpoint without additional permission checks.

The CVSS base score of 5.3 indicates moderate severity, and no EPSS score is available, so the current exploitation likelihood is unclear. The vulnerability is exploitable by any authenticated user with network access to the application; an attacker merely needs to send a crafted PUT request containing a target user ID and an arbitrary image URL. The vulnerability is not listed in CISA’s KEV catalog, suggesting that no widespread exploitation has been observed yet, but the impact on user identity and potential phishing attack vectors warrants prompt remediation.