This vulnerability affects JeecgBoot up to version 3.9.1 in the AiragModelController component. Improper access control occurs due to manipulation of the argument list/queryById, enabling remote attackers to access resources without proper authorization. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low complexity, no privileges required, and no user interaction needed. Public exploits exist. The vendor fixed the issue in version 3.9.2.

The vulnerability allows remote attackers to bypass access controls in JeecgBoot, potentially exposing sensitive data or functionality that should be restricted. The CVSS score of 5.3 indicates a moderate impact, with no privileges or user interaction required for exploitation. No known exploits in the wild have been reported beyond public exploit availability.

Upgrade affected JeecgBoot instances to version 3.9.2 or later, as this version addresses the improper access control vulnerability. Since the product is not a cloud service and no official remediation level is stated, applying the vendor's fixed version is the recommended action. Patch status is confirmed by the upgrade recommendation in the advisory.