CVE-2025-70986
HighSummary
Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data.
Risk Assessment
An attacker can gain unauthorized access to sensitive department data, potentially leading to privacy breaches and information leakage.
Recommendation
It is recommended to immediately apply patches or upgrade RuoYi to a version where access control is fixed, and review permission configurations.
Other vulnerabilities in RuoYi
See all- CVE-2026-38812Critical
RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint. The issue affects the code generation module and may allow an authenticated attacker with administrative privileges to access sensitive database information.
- CVE-2025-70985Critical
Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside their scope.
- CVE-2026-37216Medium
Ruoyi version 4.8.2 is vulnerable to Cross Site Scripting (XSS) at the interface /system/notice/add.
Original NVD description (English source)
Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data.