The vulnerability resides in the AiragPromptsController edit handler. A missing authorization check allows any authenticated user to send a PUT or POST to /airag/prompts/edit and supply a template id, thereby overwriting prompt text and model parameters that were created by administrators or other owners. The flaw is a missing authorization, classified as CWE‑862. The effect is that attackers can change AI prompt templates, which may alter the behavior of AI‑driven services and potentially disclose or manipulate sensitive prompt content.

JeecgBoot versions up to and including 3.9.5 are affected. The vulnerability is present in the airag module of JeecgBoot. Users running any earlier 3.9.x release or earlier are not impacted. Administrators of JeecgBoot installations should verify the installed version and check for updates.

The CVSS score is 5.3, indicating moderate severity. EPSS is not available, and it is not listed in the CISA KEV catalog. Attackers only need to be authenticated, so the attack vector is local application authentication. No elevated privileges or system‑wide compromise is required. The vulnerability can be exploited by sending crafted HTTP requests, so any user with a valid session token can abuse the endpoint.