JeecgBoot versions through 3.9.5 contain a missing authorization flaw in the OssFileController queryById handler. The vulnerability allows authenticated users with limited privileges to request GET /sys/oss/file/queryById for a known record id, which returns the original file name and the direct storage URL of a file uploaded by another user. This can compromise the confidentiality of other users’ data and is classified as an access control failure (CWE‑862).

The affected product is JeecgBoot up to and including version 3.9.5. Any deployment of a JeecgBoot release prior to or equal to 3.9.5 is potentially vulnerable.

The CVSS score of 5.3 indicates medium overall risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated with a low‑privilege account and must know a valid record id to exploit the flaw. Once accessed, an attacker can obtain sensitive file names and direct URLs, enabling potential further exploitation if those URLs provide open access to the storage backend.