CVE-2026-108825
Deferred Deferred - Pending Action

Improper Privilege Management in RuoYi

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A vulnerability has been found in yangzongzhuan RuoYi up to 4.8.3. This affects the function checkRoleAllowed of the file /system/role/authDataScope. Such manipulation of the argument roleKey leads to improper privilege management. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108825
EUVD
EUVD-2026-97324

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
yangzongzhuan RuoYi 4.8.0
yangzongzhuan RuoYi 4.8.1
yangzongzhuan RuoYi 4.8.2
yangzongzhuan RuoYi 4.8.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-108825 is a privilege escalation flaw in RuoYi version 4.8.3. It allows an authenticated low-privilege user to gain admin access by manipulating their role key from 'common' to 'common,admin' via the POST /system/role/authDataScope endpoint. After login, Shiro treats the user as an admin, bypassing role-based access controls.

Detection Guidance

Check for unauthorized role key modifications in RuoYi 4.8.3 by inspecting POST requests to /system/role/authDataScope. Look for roleKey values containing comma-separated roles like 'common,admin'. Verify if low-privilege users gain admin privileges without proper validation.

Impact Analysis

An attacker with a low-privilege account could escalate privileges to admin, enabling unauthorized actions like creating database tables, modifying schemas, or accessing sensitive endpoints. This could lead to data breaches, system compromise, or compliance violations.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to sensitive data or systems. GDPR and HIPAA mandate strict access controls and data protection; privilege escalation risks unauthorized data exposure or modification, leading to potential legal and regulatory penalties.

Mitigation Strategies

Upgrade RuoYi to a patched version beyond 4.8.3. Implement strict input validation for roleKey parameters to prevent comma-separated role injection. Restrict system:role:edit permissions to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108825. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart