CVE-2025-10278mediumCWE-266CWE-285

CVE-2025-10278: fallo de gravedad media en YunaiV ruoyi-vue-pro

YunaiV ruoyi-vue-pro transfer improper authorization

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear ruoyi-vue-pro

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.3%
A flaw has been found in YunaiV ruoyi-vue-pro up to 2025.09. Impacted is an unknown function of the file /crm/contact/transfer. This manipulation of the argument ids/newOwnerUserId causes improper authorization. The attack is possible to be carried out remotely. The exploit has been published and may be used. You should upgrade the affected component. The vendor confirms: "[T]he current code already checks the functional update permission, uses the authenticated server-side user ID, requires CRM OWNER permission, and explicitly rejects non-owner transfers in the shared transfer service, except for authorized CRM administrators."
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Productos afectados
YunaiV · ruoyi-vue-pro
CVEs relacionadas — YunaiV ruoyi-vue-pro

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-116006MEDIUMYunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authenticationEPSS 0.8%CVE-2026-13528MEDIUMYunaiV/zhijiantianya ruoyi-vue-pro AppFileController File Upload Endpoint FileServiceImpl.java generateUploadPath path traversalEPSS 0.6%CVE-2026-97323MEDIUMYunaiV/zhijiantianya ruoyi-vue-pro File Upload MpMaterialServiceImpl.java getOriginalFilename path traversalEPSS 0.4%CVE-2026-116007MEDIUMYunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authenticationEPSS 0.4%CVE-2026-110610MEDIUMruoyi-vue-pro through 2026.09 SSRF via Midjourney referImageUrl and notify imageUrlEPSS 0.3%CVE-2026-97325MEDIUMYunaiV/zhijiantianya ruoyi-vue-pro OAuth2 Client OAuth2ClientServiceImpl.java validOAuthClientFromCache redirectEPSS 0.3%