JeecgBoot versions up to 3.9.5 contain a missing authorization flaw in the AiragAppController queryById endpoint that allows authenticated users with insufficient privileges to read configuration data belonging to other users. The flaw enables enumeration of application IDs through the unguarded /airag/app/listDict endpoint and retrieval of system prompts, memory prompts, model IDs, knowledge base IDs, and plugin bindings that may reveal sensitive operational details. As a result, attackers can compromise the confidentiality of each app’s internal settings and potentially use that knowledge for downstream attacks.

The vulnerability impacts the JeecgBoot platform, specifically versions 3.9.5 and earlier. The affected module is the AiragApp module within the Jeecg boot framework. Administrators should confirm whether their installations are running any of these legacy versions.

The CVSS base score of 5.3 indicates a moderate risk. Since the EPSS score is not available, the likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited but remains a concern if the app is exposed to any authenticated users. Attackers would likely exploit the flaw via web requests to the exposed REST endpoints, leveraging existing authentication but without elevated privileges.