A flaw in JeecgBoot's FillRuleUtil component, specifically the /sys/fillRule/edit endpoint, allows an attacker to manipulate the ruleClass parameter. This manipulation triggers an unauthorized authorization path, enabling a threat actor to perform actions beyond the intended privileges. The vulnerability is exploitable remotely via the web interface, and the attack could let an attacker elevate privileges or execute privileged operations without authentication. The affected versions are all releases up to and including 3.9.1.

JeecgBoot, a Java-based rapid development platform, is affected. The flaw resides in the FillRuleUtil component of JeecgBoot up to version 3.9.1. No patch is currently available for earlier releases; the vendor has confirmed the issue and will provide a fix in an upcoming release.

The CVSS score of 5.3 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The description says the attack may be performed from remote, and it is inferred that the most likely attack path is a direct HTTP request to the /sys/fillRule/edit endpoint with a crafted ruleClass value. An out‑of‑the‑box public exploit exists, demonstrating that no local compromise or elevated privileges are needed beforehand, which suggests remote attackers could exploit the flaw without prior authentication.