AiragModelController in JeecgBoot permits manipulation of the queryById argument list to bypass standard access controls. The flaw stems from insufficient validation of user‑supplied arguments, allowing a remote attacker to request data that should be restricted. This results in unauthorized access to application data and potentially higher‑privilege operations, representing an access control weakness tied to CWE‑266 and CWE‑284.

Affected products are JeecgBoot applications up to version 3.9.1. The vulnerability resides in the AiragModelController component and is resolved by upgrading to release 3.9.2. No other versions or components are listed as vulnerable.

The CVSS score of 5.3 indicates a moderate severity, and no EPSS value is available; the vulnerability is not currently listed in the CISA KEV catalog. The flaw can be exploited remotely over the web interface, and an exploit is publicly available. A remote attacker can craft queryById requests to bypass permissions, subject only to network access to the affected endpoint.