JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the GET /sys/api/getUserByName endpoint. This flaw allows low-privileged authenticated users to retrieve any user's stored password value. The password data is AES-CBC encrypted, but attackers can obtain the hard-coded encryption key from another endpoint (/sys/getEncryptedString) to decrypt the passwords offline. This vulnerability can expose administrator password ciphertexts to offline guessing attacks.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the OpenApiController's queryById handler. This flaw allows low-privileged authenticated users to access OpenAPI definitions without having the required openapi permissions. Exploiting this vulnerability, attackers can retrieve sensitive internal information such as origin URLs, virtual paths, IP whitelists, and header and parameter templates by sending a GET request to /openapi/queryById with a specific entry ID. The vulnerability has a medium severity rating with a CVSS score of 4.3.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysAnnouncementController's editIzTop handler. This flaw allows low-privileged authenticated users to change the pin status of system announcements, enabling them to pin or unpin notices displayed at the top for all users. The vulnerability can be exploited via POST or PUT requests with any announcement ID. The CVSS score is 4.3, indicating medium severity.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler. This flaw allows low-privileged authenticated users to download announcement attachments by supplying a known announcement ID. Exploitation can lead to unauthorized access to ZIP files containing attachments from unreleased or user-restricted announcements. The vulnerability has a CVSS score of 4.3, indicating medium severity.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that allows any authenticated user to read MCP server configurations. This occurs because the permission check for the queryById endpoint is commented out, enabling unauthorized access to sensitive configuration data including MCP endpoint URLs, headers, and outbound authentication tokens.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the AiragPromptsController exportXls handler. This flaw allows any authenticated user, including those with low privileges, to export all AI prompts from the system. The exported data includes prompt content, model IDs, and parameters, delivered as an Excel workbook. The vulnerability has a medium severity rating with a CVSS score of 4.3.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler. This flaw allows any authenticated user, including low-privileged attackers, to send DELETE requests that permanently remove AI prompt templates from the recycle bin, even those belonging to administrators or other users. The vulnerability does not affect confidentiality but impacts integrity and availability of prompt templates.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the AiragPromptsController edit handler. This flaw allows any authenticated user, including low-privileged attackers, to modify AI prompt templates by sending PUT or POST requests to the /airag/prompts/edit endpoint. Attackers can overwrite prompt text and model parameters created by administrators or other users.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the deleteBatch handler of the AiragPromptsController. This flaw allows any authenticated user, including low-privileged attackers, to delete AI prompt templates by exploiting an unprotected list endpoint to obtain prompt IDs and passing them to the deleteBatch function. The vulnerability does not impact confidentiality but can cause integrity and availability issues by enabling unauthorized deletion of templates.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that permits low-privileged authenticated users to restore deleted AI prompt templates by invoking the revertRecycleBin endpoint. This flaw allows attackers to send PUT requests with chosen template IDs to undo deletions made by administrators.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the embeddingSearch handler of the AiragKnowledgeController. This flaw arises because the endpoint GET /airag/knowledge/embedding/search lacks Shiro permission annotations, allowing low-privileged authenticated users to access document text chunks from knowledge bases they should not have permission to read. The vulnerability has a medium severity with a CVSS score of 4.3.
JeecgBoot versions through 3.9.5 have an authorization bypass vulnerability in the getVideoRecords handler of the VideoGenerationController. This flaw allows authenticated users with low privileges to access other users' AI video generation history by manipulating the userId parameter. The exposed data includes prompts, task IDs, video URLs, and cover URLs. The vulnerability has a CVSS 3.1 base score of 4.3, indicating medium severity.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the getUserPermissionSet handler of SystemApiController. This flaw allows any authenticated user to supply an arbitrary userId to the GET /sys/api/getUserPermissionSet endpoint and retrieve the full permission set of any account, including administrators. The vulnerability does not allow modification of data but exposes sensitive permission information. It has a CVSS score of 4.3, indicating medium severity.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product packs. This occurs via the PUT /sys/tenant/deleteTenantPackUser endpoint, where attackers can specify arbitrary userId and packId values to revoke permissions, including tenant administrator access.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the queryPageList handler of the OpenApiController. This flaw allows any authenticated user, including low-privileged attackers, to access the GET /openapi/list endpoint and retrieve sensitive OpenAPI registry information such as virtual paths, internal origin URLs, IP whitelists, and administrative header and parameter templates. The vulnerability has a medium severity with a CVSS score of 4.3.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysTenantController deleteApply handler. This flaw allows any authenticated user, including low-privileged attackers, to reject tenant administrator applications by sending crafted PUT requests. The attacker can specify tenantId, packId, and userId values to delete pending applications and notify applicants of rejection.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the OssFileController queryById handler. This flaw allows low-privileged authenticated users to access object storage file records belonging to other users by requesting GET /sys/oss/file/queryById with a known record ID. The vulnerability exposes original file names and direct storage URLs without proper access control.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the queryUserRolesById handler of SystemApiController. This flaw allows authenticated users with low privileges to read any user's role codes by sending a userId to the GET /sys/api/queryUserRolesById endpoint. Attackers can enumerate role assignments and identify administrator accounts. The vulnerability has a CVSS score of 4.3, indicating medium severity.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysTenantController passApply handler. This flaw allows any authenticated user to approve tenant administrator applications without proper authorization. An attacker can submit a pending application and then approve it to gain tenant administrator privileges in any tenant.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that allows any authenticated user to modify tenant settings via a specific API call. This flaw permits low-privileged attackers to change the applyStatus field of any tenant by supplying its tenant ID, potentially enabling or disabling tenant administrator applications across tenants. The vulnerability has a medium severity rating with a CVSS score of 4.3.