CVE-2025-10989
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A security flaw was discovered in yangzongzhuan RuoYi up to 4.8.1. The file /system/role/authUser/selectAll is affected; manipulating the userIds argument results in improper authorization. The attack can be initiated remotely and the exploit has been released. The vendor was contacted but did not respond.
Risk Assessment
A remote attacker may gain unauthorized access to system functions, potentially leading to data confidentiality breaches or privilege escalation.
Recommendation
Update RuoYi to the latest version or apply temporary mitigations such as server-side authorization checks.
Other vulnerabilities in RuoYi
See all- CVE-2026-108825Medium
A vulnerability was found in RuoYi up to version 4.8.3 in the checkRoleAllowed function of the /system/role/authDataScope file. Manipulation of the roleKey argument leads to improper privilege management. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2025-70986High
Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data.
- CVE-2026-38812Critical
RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint. The issue affects the code generation module and may allow an authenticated attacker with administrative privileges to access sensitive database information.
- CVE-2025-70985Critical
Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside their scope.
- CVE-2026-108803Medium
A security vulnerability has been detected in y_project RuoYi up to 4.8.3. It impacts the function changeStatus of the file /system/config/add of the component Disable API. The manipulation leads to session expiration. The attack can be initiated remotely. The vendor was contacted but did not respond.
- CVE-2026-108800Medium
A vulnerability in RuoYi 4.8.3 involves an unknown function that allows cross-site request forgery (CSRF). The attack can be executed remotely.
- CVE-2026-37216Medium
Ruoyi version 4.8.2 is vulnerable to Cross Site Scripting (XSS) at the interface /system/notice/add.
Original NVD description (English source)
A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This vulnerability affects unknown code of the file /system/role/authUser/selectAll. Performing manipulation of the argument userIds results in improper authorization. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS