The vulnerability exists in a component of JeecgBoot, specifically an unknown function in the /sys/comment/add path. Misconfigured or missing authorization checks allow attackers to invoke the add comment operation without proper authentication or authorization. The flaw is an instance of both improper access control (CWE-284) and failure to restrict access (CWE-266). When activated, an attacker can add comments or otherwise manipulate data that should be protected, potentially exposing sensitive information or undermining user privileges. The CVSS base score of 5.3 places the flaw in the medium severity range.

All installations of JeecgBoot through version 3.9.1 are affected, as the issue resides in the core application code. Users running v3.9.1 or older are at risk; versions 3.9.2 and newer contain the mitigation.

The flaw can be exploited remotely by sending crafted requests to the /sys/comment/add endpoint, and the vulnerability is publicly documented and likely has a publicly available exploit. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog, so the overall exploitation potential is uncertain but the remote nature raises concern. The moderate CVSS score indicates that the impact is limited to unauthorized data manipulation rather than full system compromise, but the ability to alter or inject information is still significant.