JeecgBoot versions up to 3.9.5 contain a missing authorization flaw in the AiragPromptsController that permits any authenticated user to call DELETE /airag/prompts/delete and remove AI prompt templates. The deletion removes the template from the database, making it unavailable to all users who rely on it, which effectively breaches the availability of the AI prompting feature. The weakness is a classic Missing Authorization error (CWE-862).

Any deployment of JeecgBoot running version 3.9.5 or earlier is affected. The vulnerability specifically resides in the Airag module of the JeecgBoot application; no other products or versions are listed as impacted.

The CVSS score of 5.3 indicates moderate severity; the attack requires that the attacker already be authenticated to the application, as it relies on the lack of authorization checks for the delete operation. EPSS data are not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation at present. The attacker can learn template identifiers through the unprotected GET /airag/prompts/list endpoint and then perform the delete, compromising all users' access to the affected prompts.