The vulnerability in JeecgBoot’s QuartzJobController allows low‑privileged authenticated users to retrieve detailed job metadata—including class names, cron expressions, and parameters—through a GET request to /sys/quartzJob/queryById. This lack of authorization permits attackers to read data that was intended for administrative use, thereby compromising confidentiality of scheduled job configuration.

Affected by the missing authorization flaw are all installations of JeecgBoot up to and including version 3.9.5. Users of newer releases are presumed to be unaffected unless otherwise noted by the vendor.

The CVSS Base score of 5.3 indicates a moderate severity, reflecting that an attacker requires authentication but not elevated privileges. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation is straightforward: an attacker authenticates with any valid account and sends a GET request to the vulnerable endpoint with a job ID. No daemon bypass or remote code execution is required, but the disclosed data can aid further attacks against the system.