CVE-2026-57950
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A broken access control vulnerability in ruoyi-vue-pro through 2026.05 (fixed in commit 5d1fd70) in ErpSaleOrderController allows attackers with erp:sale-out permissions to gain unauthorized access to sale order operations due to incorrect permission namespace enforcement. Attackers can perform unauthorized create, update, delete, and read operations on financially sensitive sale orders.
Risk Assessment
The risk is that users with only shipment-level permissions can manipulate sale orders, potentially causing financial losses, data integrity issues, and unauthorized transactions.
Recommendation
Apply commit 5d1fd70 or upgrade to a version newer than 2026.05 immediately, and verify the permission configuration for ErpSaleOrderController to enforce the erp:sale-order namespace.
Other vulnerabilities in ruoyi-vue-pro
See all- CVE-2026-57949Medium
A missing authorization vulnerability in the CRM module of ruoyi-vue-pro (up to version 2026.05, fixed in commit c779a47) exists in the GET /admin-api/crm/follow-up-record/get endpoint. Authenticated users can read any follow-up record by iterating sequential numeric IDs.
- CVE-2026-13528High
A path traversal vulnerability was found in ruoyi-vue-pro up to version 2026.04-jdk8-SNAPSHOT in the generateUploadPath function of FileServiceImpl.java. An attacker can remotely manipulate the file path, leading to unauthorized access to resources.
Original NVD description (English source)
ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a broken access control vulnerability in ErpSaleOrderController that allows attackers with erp:sale-out permissions to gain unauthorized access to sale order operations by exploiting an incorrect permission namespace enforcement. Attackers holding shipment-level permissions can perform unauthorized create, update, delete, and read operations on financially sensitive sale orders due to the controller enforcing erp:sale-out instead of the intended erp:sale-order namespace.