The vulnerability is a missing authorization flaw in the deleteBatch handler of AiragPromptsController that allows any authenticated user to delete AI prompt templates. Low‑privileged attackers can obtain prompt IDs through the public list endpoint and send them to the deleteBatch endpoint to remove templates created by administrators or other users, disrupting AI functionality and erasing data.

Products affected are JeecgBoot up to and including version 3.9.5. The flaw resides in the AiragPromptsController within the Airag module of JeecgBoot; no other vendors or product versions are known to be impacted.

The CVSS score of 5.3 indicates moderate risk. The EPSS score is not available and the vulnerability is not listed in CISA KEV. Attack requires an authenticated session, so the threat is primarily to users with credentials. If credentials are compromised or widely available, adversaries could delete prompt templates, resulting in data loss and service disruption.