CVE-2026-122016mediumCWE-266CWE-269

CVE-2026-122016: medium-severity vulnerability in yangzongzhuan RuoYi-Vue

yangzongzhuan RuoYi-Vue Permission Service SysPermissionService.java SysPermissionService.getMenuPermission privileges management

Published

Follow this CVE+ Monitor RuoYi-Vue

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.3%
A vulnerability was determined in yangzongzhuan RuoYi-Vue up to 3.9.2. This issue affects the function SysPermissionService.getMenuPermission of the file SysPermissionService.java of the component Permission Service. This manipulation of the argument perms causes improper privilege management. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
Affected products
yangzongzhuan · RuoYi-Vue
Related CVEs — yangzongzhuan RuoYi-Vue

In the same product, most dangerous first.

CVE-2026-76576MEDIUMyangzongzhuan RuoYi-Vue Common Download Endpoint CommonController.java resourceDownload path traversalEPSS 0.5%CVE-2025-4537LOWyangzongzhuan RuoYi-Vue Password login.vue sensitive information in a cookieEPSS 0.3%CVE-2026-9374MEDIUMyangzongzhuan RuoYi-Vue Common Upload Endpoint upload FileUploadUtils.upload unrestricted uploadEPSS 0.2%