The vulnerability in JeecgBoot permits authenticated users to bypass authorization checks when calling the deleteRecycleBin endpoint, enabling them to permanently delete AI prompt templates stored in the recycle bin. This flaw can be exploited by low‑privileged users to remove templates belonging to administrators or other users, resulting in loss of data and potential disruption of application functionality. The weakness aligns with the CWE-862 definition of missing authorization controls.

JeecgBoot versions 3.9.5 and earlier are affected. The flaw resides in the AiragPromptsController module, specifically the deleteRecycleBin handler, and would impact any deployment of these versions that has the endpoint exposed to authenticated users.

With a CVSS score of 5.3, the vulnerability is rated as moderate severity. Exploitation requires only authentication, and attackers can issue simple DELETE requests to the vulnerable path. No publicly available exploit code is reported, and the vulnerability is not listed in the CISA KEV catalog, but the potential for data loss and the lack of an authorization gate make it worthwhile to address proactively. The EPSS score is not provided, so the exact likelihood of exploitation remains uncertain.