The flaw arises from a missing authorization check in the queryPageList handler of OpenApiController. As a result, any user who is authenticated can invoke GET /openapi/list and retrieve the OpenAPI registry definitions. The response contains virtual paths, internal origin URLs, IP whitelists, and header and parameter templates that are normally reserved for administrators, exposing confidential configuration data. This issue is classified as CWE‑862: Missing Authorization.

JeecgBoot versions through 3.9.5 are affected. The problem exists in the OpenApiController component of the JeecgBoot application, which is identified by the jeecg:jeecg_boot CPE. Users running these versions should verify their installed release and consider upgrading.

The CVSS score of 5.3 marks the vulnerability as medium severity, and it is not listed in the CISA KEV catalog. Exploitation requires only that the attacker has valid user credentials; once authenticated, the GET /openapi/list request can be made from any client that reaches the application. The absence of an EPSS score suggests that publicly known exploits are not documented, but the potential to leak sensitive configuration data remains a concern for environments where authenticated users have broad access privileges.