JeecgBoot up to version 3.9.5 contains a missing authorization flaw (CWE‑862) in the AiragKnowledgeController’s embeddingSearch method. The endpoint accepts GET requests with a knowledge base identifier and returns document text chunks without validating the caller’s permissions. As a result, an authenticated user with any account can read content from knowledge bases that they are not authorized to view, exposing sensitive data.

The flaw is present in JeecgBoot, version 3.9.5, affecting the /airag/knowledge/embedding/search endpoint. No other versions are listed in the advisory.

The CVSS score of 5.3 classifies the risk as moderate. The lack of an EPSS score and absence from the CISA KEV catalog suggests limited public exploitation at this time. The attack path requires authenticated access via an HTTP GET request to the vulnerable endpoint, a capability that is likely available to users with low‑privileged accounts. Because the flaw is limited to data disclosure, the primary concern is confidentiality loss rather than system compromise.