CVE-2025-70985
CriticalSummary
Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside their scope.
Risk Assessment
Attackers can modify data they should not access, potentially leading to data integrity issues and privilege escalation.
Recommendation
Update RuoYi to the latest patched version and audit access controls in the update function.
Other vulnerabilities in RuoYi
See all- CVE-2025-70986High
Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data.
- CVE-2026-38812Critical
RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint. The issue affects the code generation module and may allow an authenticated attacker with administrative privileges to access sensitive database information.
- CVE-2026-37216Medium
Ruoyi version 4.8.2 is vulnerable to Cross Site Scripting (XSS) at the interface /system/notice/add.
Original NVD description (English source)
Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their scope.