JeecgBoot 3.9.5 and earlier versions have a missing authorization vulnerability in /airag/airagMcp/queryById

JeecgBoot 3.9.5 and earlier versions have a missing authorization vulnerability (CWE-862, CVSS 7.1), allowing any authenticated user to read MCP server configurations. Because the permission check in queryById is commented out, an attacker can first obtain record IDs from the unprotected /airag/app/queryById endpoint, then use them to obtain MCP endpoint URLs, request headers, and outbound authentication tokens.