A server‑side request forgery vulnerability exists in the OpenApiController.add and OpenApiController.call functions of JeecgBoot’s OpenApiService. An attacker can manipulate the originUrl argument stored in the database, causing the server to make unintended HTTP requests on the attacker’s behalf. The flaw allows remote exploitation, potentially enabling the attacker to reach internal network resources or external services, compromising confidentiality and integrity without direct code execution.

JeecgBoot OpenApi Service implementations up to version 3.9.1 are affected. The vulnerability originates in OpenApiController.java and applies to all deployments using the affected component. No later versions are listed as impacted, but the vendor has confirmed the issue and promised a fix in an upcoming release.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score is not available. The flaw is not catalogued in CISA’s KEV, yet publicly available exploit code has been reported. Because the vulnerability is accessed remotely via the exposed OpenAPI endpoints, an attacker only needs network connectivity to the service to craft malicious originUrl values, making SSRF a realistic threat in environments where the application can reach internal or external hosts.