CVE-2026-108825— yangzongzhuan RuoYi authDataScope checkRoleAllowed privileges management
Quick assessment
Affected
yangzongzhuan RuoYi
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 yangzongzhuan RuoYi（版本 <= 4.8.3）中发现了一个漏洞。该漏洞影响文件 中的 函数。对参数 的操控会导致权限管理不当。攻击者可以远程发起攻击。该漏洞已被公开披露，且可能被利用。厂商早在披露前即已获知该漏洞，但未作出任何回应。
Possible ATT&CK Techniques 1 AI
T1078 · Valid AccountsAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| yangzongzhuan | RuoYi | 4.8.0 |
affected |
4.8.1 |
affected | ||
4.8.2 |
affected | ||
4.8.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-108825
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
yangzongzhuan RuoYi authDataScope checkRoleAllowed privileges management
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability has been found in yangzongzhuan RuoYi up to 4.8.3. This affects the function checkRoleAllowed of the file /system/role/authDataScope. Such manipulation of the argument roleKey leads to improper privilege management. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| yangzongzhuan | RuoYi | 4.8.0 |
cpe:2.3:a:ruoyi:ruoyi:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-108825
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-108825
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-108825 (1)
IV. Related Vulnerabilities
Same product: RuoYi
-
CVE-2026-108803
y_project RuoYi Disable API add changeStatus session expirat -
CVE-2026-108802
y_project RuoYi Dictionary Data Drawer Preview add renderDra -
CVE-2026-108800
yangzongzhuan RuoYi cross-site request forgery -
CVE-2026-4564
yangzongzhuan RuoYi Quartz Job job code injection -
CVE-2025-14856
y_project RuoYi getnames code injection
Same vendor: yangzongzhuan
-
CVE-2026-108800
yangzongzhuan RuoYi cross-site request forgery -
CVE-2026-76576
yangzongzhuan RuoYi-Vue Common Download Endpoint CommonContr -
CVE-2026-9374
yangzongzhuan RuoYi-Vue Common Upload Endpoint upload FileUp -
CVE-2026-4564
yangzongzhuan RuoYi Quartz Job job code injection -
CVE-2025-10989
yangzongzhuan RuoYi selectAll improper authorization
Same weakness: CWE-269
-
CVE-2026-73802
Gitea Runner host isolation bypass through container options -
CVE-2026-110633
MyReport Updater through 2.1.1 Local Privilege Escalation vi -
CVE-2026-104748
SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation -
CVE-2026-104767
Membership & User Roles for WooCommerce (Automatic Role Chan -
CVE-2026-104749
Bit integrations <= 2.10.6 - Unauthenticated Privilege Escal
V. Comments for CVE-2026-108825
No comments yet