CVE-2025-46175
📋 TL;DR
Ruoyi v4.8.0 has an incorrect access control vulnerability where the authRole method in SysUserController.java lacks a checkUserDataScope permission check. This allows authenticated users to potentially access or modify data beyond their authorized scope. Organizations using Ruoyi v4.8.0 for permission management are affected.
💻 Affected Systems
- Ruoyi
📦 What is this software?
Ruoyi by Ruoyi
⚠️ Risk & Real-World Impact
Worst Case
Authenticated users could escalate privileges to access sensitive data or perform unauthorized administrative actions, potentially leading to data breach or system compromise.
Likely Case
Users bypass intended data scope restrictions to view or modify information they shouldn't have access to, violating data segregation policies.
If Mitigated
With proper network segmentation and least privilege principles, impact is limited to unauthorized data access within the application layer.
🎯 Exploit Status
Exploit requires authenticated access. The vulnerability is publicly documented with code examples.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit f935b2782f4237cdbcc13bdce76703e82c42f4fe
Vendor Advisory: https://gitee.com/y_project/RuoYi/issues/IC1FS0
Restart Required: Yes
Instructions:
1. Update to the latest Ruoyi version or apply commit f935b2782f4237cdbcc13bdce76703e82c42f4fe. 2. Rebuild and redeploy the application. 3. Restart the application server.
🔧 Temporary Workarounds
Add manual permission check
allManually add checkUserDataScope permission validation in the authRole method before processing requests.
Edit SysUserController.java to include proper permission checks before authRole logic
🧯 If You Can't Patch
- Implement network-level access controls to restrict which users can reach the vulnerable endpoint.
- Enable detailed audit logging for all authRole method calls and monitor for unauthorized access patterns.
🔍 How to Verify
Check if Vulnerable:
Review SysUserController.java for missing checkUserDataScope call in authRole method. Check if running Ruoyi v4.8.0.Check Version:
Check application version in Ruoyi admin panel or review project configuration files.Verify Fix Applied:
Confirm checkUserDataScope is properly implemented in authRole method and test with different user roles.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to authRole endpoint
- User accessing data outside their normal scope
Network Indicators:
- Unusual API calls to /system/user/authRole from non-admin users
SIEM Query:
source="ruoyi_app" AND endpoint="/system/user/authRole" AND user_role!="admin"