CVE-2026-108825: fallo de gravedad media en yangzongzhuan RuoYi
yangzongzhuan RuoYi authDataScope checkRoleAllowed privileges management
Publicada el · Actualizada el
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 5.3epss 0.2%
probabilidad de explotación
0.2%top 87% de las CVE
explotación observada
noninguna fuente lo reporta
1 exploit(s) público(s)
A vulnerability has been found in yangzongzhuan RuoYi up to 4.8.3. This affects the function checkRoleAllowed of the file /system/role/authDataScope. Such manipulation of the argument roleKey leads to improper privilege management. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Productos afectados
yangzongzhuan · RuoYiPoCs públicas encontradas — 1
cve_referencegithub.com/Bob-wentao/security-report-for-ruoyi-role-key-authorization/blob/main/security-report-ruoyi-4.8.3-role-key-authorization.mdno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — yangzongzhuan RuoYi
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-7901MEDIUMyangzongzhuan RuoYi Swagger UI index.html cross site scriptingEPSS 0.9%CVE-2025-7907MEDIUMyangzongzhuan RuoYi Druid application-druid.yml default credentialsEPSS 0.5%CVE-2025-10473MEDIUMyangzongzhuan RuoYi Blacklist SqlUtil.java filterKeyword sql injectionEPSS 0.4%CVE-2025-10989MEDIUMyangzongzhuan RuoYi selectAll improper authorizationEPSS 0.4%CVE-2025-10384MEDIUMyangzongzhuan RuoYi Role cancelAll improper authorizationEPSS 0.4%CVE-2025-7906MEDIUMyangzongzhuan RuoYi CommonController.java uploadFile unrestricted uploadEPSS 0.4%