The vulnerability is a missing authorization check in the AiragPromptsController exportXls endpoint of JeecgBoot versions up to 3.9.5. Any authenticated user, regardless of privilege level, can request the /airag/prompts/exportXls URL and obtain an Excel workbook containing every user’s prompts, model identifiers and parameters. This results in the disclosure of potentially sensitive content and internal configuration data. The weakness aligns with CWE-862, which describes improper authorization controls.

The affected vendor is JeecgBoot and the product JeecgBoot. Versions up to and including 3.9.5 contain the flaw; versions beyond 3.9.5 are not known to be vulnerable.

The CVSS v3 base score of 5.3 indicates a moderate impact profile. EPSS is not available for this entry and the vulnerability is not listed in CISA KEV, suggesting no known large-scale exploitation reports. An attacker only needs to be authenticated to trigger the vulnerability; the exploit path requires no special privileges beyond legitimate login credentials. Consequently, the primary risk is unauthorized data disclosure rather than code execution or system compromise.