JeecgBoot versions up to 3.9.5 contain a missing authorization flaw that allows authenticated users to call the /airag/prompts/revertRecycleBin endpoint. By sending a PUT request with selected template ids, a user can clear the deleted flag on templates that have been removed by an administrator, effectively restoring them. This flaw is a classic example of CWE-862 – Missing Authorization. The impact is that legitimate deletion actions by administrators can be undone by lower-privileged users, potentially compromising data integrity and violating intended workflows.

The vulnerability affects JeecgBoot products released through version 3.9.5. Users running any build of JeecgBoot up to and including 3.9.5 are susceptible.

The CVSS score of 5.3 indicates a moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, so the likelihood of widespread exploitation is considered low. Attackers need only an authenticated account with non-administrative privileges to send the PUT request. The vulnerability is therefore exploitable within the user’s own system or a trusted network where the API is exposed, but it does not allow remote exploitation from unauthenticated users.