JeecgBoot CVE-2026-9604

Requires a valid authenticated session with at minimum low-privilege credentials (confirmed by CVSS PR:L). The AiragModelController component must be active, meaning the target deployment must be running JeecgBoot with its AI/RAG module enabled - this feature was introduced in recent versions and may not be present in older or minimal deployments. No additional configuration, special role, or network position beyond authenticated remote access is required. Exploitation is limited by the authentication prerequisite: unauthenticated external attackers cannot exploit this without first obtaining credentials. The confidentiality impact is bounded to AI model configuration data accessible through the list and queryById operations; no write, delete, or code execution capability is indicated by the CVSS vector (I:N, A:N).

The CVSS base score of 4.3 (Medium) is proportionate: AV:N (network-reachable) and AC:L (no special conditions) increase accessibility, but PR:L (low privileges required) and C:L (limited confidentiality impact with no integrity or availability loss) constrain real-world severity. The temporal metrics in the vector (E:P/RL:O/RC:C) confirm a proof-of-concept exploit exists, an official fix is released, and the vulnerability is confirmed - these are consistent with the multi-source intelligence. No EPSS score was provided, so exploitation probability cannot be quantified beyond the POC signal. No CISA KEV listing was provided, meaning active in-the-wild exploitation is not confirmed. The 'Authentication Bypass' tag in the source data is misleading: the CVSS PR:L value indicates an authenticated attacker is required, so this is more precisely an authorization bypass (access to data beyond one's privilege level). For multi-tenant SaaS deployments of JeecgBoot - a common use case per the release notes - the cross-tenant data exposure risk may exceed what the base CVSS score implies, since AI model configurations could expose API keys or sensitive model endpoints.

An attacker with any valid JeecgBoot account (low-privilege user, such as a standard employee account in a multi-tenant deployment) sends unauthenticated-style HTTP GET requests to the AiragModelController's /list or /queryById endpoints. Because no authorization check enforces role requirements, the server returns AI model configuration data - potentially including model endpoint URLs, API keys, or tenant-specific AI assistant configurations - that should be restricted to administrators. A proof-of-concept demonstrating this behavior is publicly documented in GitHub issue #9599.