JeecgBoot versions up to and including 3.9.5 allow any authenticated user to invoke the editThirdAppConfig endpoint without proper authorization checks. This flaw enables users to alter critical third‑party integration settings such as client identifiers, secrets, agent IDs, and corporate IDs for DingTalk, WeCom, or Feishu connections. By manipulating these values, an attacker can redirect directory synchronization and messaging flows to malicious applications, effectively hijacking communications and compromising data integrity and confidentiality.

The affected product is JeecgBoot, specifically all releases up to version 3.9.5 as identified by the CNA vendor product mapping and the CPE string for jeecg_boot.

The CVSS score for this vulnerability is 7.1, indicating a high potential impact. The EPSS score is not available, so the precise probability of exploitation is uncertain, but the flaw is easily exploitable by anyone who can authenticate to the system. Because the exploit does not require elevated privileges, low‑privileged accounts can trigger the abuse. The vulnerability is not listed in the CISA KEV catalog, yet the lack of authorization controls makes it a significant risk that could be leveraged by attackers with legitimate credentials. The model attack path is a remote, authenticated web request to the /sys/thirdApp/editThirdAppConfig endpoint. Once executed, configuration changes can be made that could redirect or intercept enterprise messaging and synchronization.