CVE-2025-10989
📋 TL;DR
This vulnerability in yangzongzhuan RuoYi up to version 4.8.1 allows attackers to bypass authorization controls by manipulating the userIds parameter in the /system/role/authUser/selectAll endpoint. Attackers can remotely exploit this flaw to access unauthorized data or perform unauthorized actions. All users running RuoYi versions up to 4.8.1 are affected.
💻 Affected Systems
- yangzongzhuan RuoYi
📦 What is this software?
Ruoyi by Ruoyi
⚠️ Risk & Real-World Impact
Worst Case
Attackers could gain administrative privileges, access sensitive user data, modify system configurations, or perform unauthorized administrative actions across the entire RuoYi system.
Likely Case
Attackers exploit the vulnerability to access user data they shouldn't have permission to view, potentially exposing personally identifiable information or sensitive business data.
If Mitigated
With proper network segmentation and access controls, the impact is limited to unauthorized data access within the RuoYi application scope.
🎯 Exploit Status
The exploit has been released publicly and requires some authentication but bypasses authorization checks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
Upgrade to a version above 4.8.1 if available. Since vendor hasn't responded, monitor official channels for updates.
🔧 Temporary Workarounds
Block vulnerable endpoint
allRestrict access to the /system/role/authUser/selectAll endpoint using web application firewall or network controls
Implement input validation
allAdd server-side validation for userIds parameter to ensure proper authorization checks
🧯 If You Can't Patch
- Implement strict network segmentation to isolate RuoYi systems from sensitive networks
- Deploy web application firewall with rules to detect and block exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check if RuoYi version is 4.8.1 or earlier and if /system/role/authUser/selectAll endpoint is accessibleCheck Version:
Check RuoYi version in application interface or configuration filesVerify Fix Applied:
Test if authorization bypass is possible by attempting to access unauthorized user data through the vulnerable endpoint📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to /system/role/authUser/selectAll
- Multiple failed authorization attempts followed by successful access
- Requests with manipulated userIds parameters
Network Indicators:
- HTTP requests to /system/role/authUser/selectAll with unusual userIds patterns
- Traffic from unexpected sources to administrative endpoints
SIEM Query:
source="ruoyi_app" AND uri="/system/role/authUser/selectAll" AND (userIds="*" OR userIds CONTAINS "admin" OR userIds CONTAINS "1,2,3")