This vulnerability in JeecgBoot 3.9.1 involves improper authentication caused by some unspecified processing flaw in the /openapi/call/ endpoint of the OpenAPI component. The flaw allows remote attackers to bypass authentication controls under conditions requiring high attack complexity. The CVSS 4.0 base score is 6.3 (medium severity), reflecting network attack vector, high complexity, no privileges or user interaction required, and limited impact on integrity. The vendor has not provided any advisory or fix, and no exploits are known publicly.

Successful exploitation could allow an unauthenticated remote attacker to bypass authentication mechanisms on the affected endpoint, potentially gaining unauthorized access to functionality or data protected by authentication. The impact on confidentiality, integrity, and availability is limited according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or vendor advisory is available, users should monitor for updates from the vendor. Until a patch is released, consider restricting access to the /openapi/call/ endpoint via network controls or other compensating controls to reduce exposure.