A flaw in the Boot Actuator Endpoint of erzhongxmu JeeWMS allows remote manipulation of the /base-boot/actuator path, causing an endpoint to reveal sensitive internal information. The vulnerability is classified as Information Exposure (CWE‑200) and Improper Authorization (CWE‑284), enabling an attacker to gain unintended access to data likely held by the actuator service.

The affected product is erzhongxmu JeeWMS; the disclosed issue exists in all releases up to commit 141740afb2ba14d441c82a833d0a418d07ca2d69. Because the vendor uses a rolling‑release model, specific version numbers are not published, so any instance built on the code base identified by the commit hash is potentially vulnerable.

The CVSS score of 6.9 indicates a moderate risk, and the exploit is publicly available. The EPSS score is not available, but the lack of a KEV listing does not reduce the likelihood that attackers will target the exposed endpoint. An attacker only needs network access to the actuator URL, and can gain unauthorized information without authentication or other prerequisites.