JeecgBoot EUVD-2026-96604

Exploitation requires a valid authenticated JeecgBoot account of any privilege level (PR:L) and reachability of the /airag/prompts/edit endpoint, meaning the AIRAG/AI prompts module must be deployed and enabled. The attacker must supply a target template id created by an administrator or another user. Limiting factors: authentication is mandatory (no anonymous exploitation), the impact is confined to tampering with AI prompt templates and model parameters (integrity only - no data disclosure or service disruption), and the AIRAG module must be in use. No special non-default configuration or user interaction is otherwise required.

This is a genuine but moderate-risk issue, not a critical priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 Medium score are internally consistent with the description: network-reachable, low attack complexity, but requiring an authenticated low-privileged account (PR:L) and yielding only limited integrity impact (VI:L) with no confidentiality or availability loss. CWE-862 (Missing Authorization) matches the described flaw - a logged-in user editing another user's or an admin's AI prompt templates. Public exploit code exists (github-poc) and the finding was reported by a credible source (VulnCheck), which raises practical exploitability, but there is NO CISA KEV listing and no EPSS score was supplied, so there is no evidence of active, widespread exploitation. The 'Authentication Bypass' tag is misleading: this is a post-authentication authorization (access-control) flaw, not an authentication bypass - exploitation requires valid credentials. Net assessment: a real, easily-triggered authorization defect worth patching, but its impact ceiling (tampering with prompt templates, not RCE or data theft) keeps it below high-priority emergency status.

An attacker who has obtained any low-privileged JeecgBoot account (self-registered or compromised) sends a crafted PUT or POST request to /airag/prompts/edit referencing a prompt template id belonging to an administrator, overwriting its prompt text and model parameters. A public proof-of-concept exists, and because attack complexity is low this requires only a valid session and a known/guessable template id; no user interaction is needed.