JeecgBoot EUVD-2026-97051

Exploitation requires a valid authenticated session on the JeecgBoot instance at a low privilege level (CVSS PR:L) - it is NOT remote-unauthenticated. The specific prerequisite is reachability of the AiragPromptsController AIRAG prompt endpoints, i.e., the AI/RAG prompts feature must be present and exposed (JeecgBoot's jeecg-boot-module-airag module). The DELETE /airag/prompts/delete endpoint lacks per-object ownership/authorization checks, and the GET /airag/prompts/list endpoint is unguarded, enabling ID enumeration. Limiting factors: the attacker must hold credentials for any account (mitigated on instances with no untrusted/self-registered users), no user interaction is needed, and impact is confined to logical deletion of AI prompt templates (availability/integrity of those objects) with no confidentiality exposure and no system-level compromise.

This is a genuine but low-to-moderate priority issue, and the signals are internally consistent rather than conflicting. The vendor-provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 base score agree with the description: network-reachable, low-complexity, but requiring an authenticated low-privileged account (PR:L), with no confidentiality impact and only limited integrity/availability impact (VI:L/VA:L) and no scope change. The impact is narrow - an authenticated user can logically delete other users' AI prompt templates (availability/integrity of specific data objects), not achieve RCE, data theft, or full system compromise. A public POC exists (reported by VulnCheck, with a GitHub exploit script), which raises practical exploitability, but there is NO CISA KEV listing and no EPSS score was provided, so there is no evidence of active, widespread exploitation - the POC availability and absence of KEV together suggest opportunistic/targeted abuse potential rather than mass exploitation. The main risk driver is that the GET /airag/prompts/list endpoint is unguarded, making target IDs trivially enumerable for any logged-in user. No key signals are missing or contradictory; the chief caveat is the absence of EPSS data to quantify exploitation probability.

A low-privileged but authenticated user (e.g., any registered account on a JeecgBoot instance) queries the unguarded GET /airag/prompts/list endpoint to enumerate prompt template IDs belonging to other users, then issues DELETE /airag/prompts/delete for each ID to logically remove them, denying those templates to all users. A public POC script (poc_airag_prompts_delete.py) automates this end to end. Because the attack is network-based and low-complexity, it requires only valid low-level credentials and no user interaction.