CVE-2026-108825

MEDIUMCVSS 5.4

Description

A vulnerability has been found in yangzongzhuan RuoYi up to 4.8.3. This affects the function checkRoleAllowed of the file /system/role/authDataScope. Such manipulation of the argument roleKey leads to improper privilege management. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Timeline

Published:October 12th, 2026 11:17 AM

Last modified:October 15th, 2026 4:17 PM

CVSS Scoring

CVSS v3: 5.4 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

CVSS v2: 5.5

Weaknesses (CWE)

CWE-266 CWE-269

References & Reports

Advisories, patches, and third-party reports

https://github.com/Bob-wentao/security-report-for-ruoyi-role-key-authorization/blob/main/security-report-ruoyi-4.8.3-role-key-authorization.md
https://vuldb.com/cve/CVE-2026-108825
https://vuldb.com/submit/967058
https://vuldb.com/vuln/416601
https://vuldb.com/vuln/416601/cti

Source: NIST NVD · Data may lag official sources by up to one minute