Medium severity · published Oct 12, 2026
CVE-2026-108825
yangzongzhuan RuoYi authDataScope checkRoleAllowed privileges management
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability has been found in yangzongzhuan RuoYi up to 4.8.3. This affects the function checkRoleAllowed of the file /system/role/authDataScope. Such manipulation of the argument roleKey leads to improper privilege management. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RU
RuoYi · yangzongzhuan
4.8.0; 4.8.1; 4.8.2; 4.8.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-108825
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-108825
vdb-entry
https://vuldb.com/vuln/416601
signature
https://vuldb.com/vuln/416601/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-108825
third-party-advisory
https://vuldb.com/submit/967058
exploit
https://github.com/Bob-wentao/security-report-for-ruoyi-role-key-authorization/blob/main/security-report-ruoyi-4.8.3-role-key-authorization.md
More from RuoYi
10.0
CVE-2024-57521
SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in SqlUtil.java
9.8
CVE-2025-10473
yangzongzhuan RuoYi Blacklist SqlUtil.java filterKeyword sql injection
9.8
CVE-2025-28402
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameter
9.8
CVE-2025-28405
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus method
9.8
CVE-2025-28413
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController component