Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-70986: RuoYi v4.8.2: Unauthorized access to department data

CVE-2025-70986 · published 9 months ago

Summary

The RuoYi system has a security issue that allows anyone to view sensitive information about departments, even if they shouldn't have access to it. This could lead to unauthorized disclosure of confidential data. Update to the latest version of RuoYi to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
ruoyi	ruoyi	4.8.1 4.8.2 `cpe:2.3:a:ruoyi:ruoyi:4.8.1:::::::*`

Original advisory text

Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data.

References

https://gist.github.com/old6ma/779320a98f361c299ca024521cb72db6 URL
https://gitee.com/y_project/RuoYi URL
https://gitee.com/y_project/RuoYi/issues/IDIDME URL
https://github.com/yangzongzhuan/RuoYi Product
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/70xxx/CVE-2025-70986... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-70986 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.5 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-284Improper Access Control

CWE-862Missing Authorization

Timeline

Published23 Jan 2026

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-70986 · NVD

CVE-2025-70986 · OSV

Track software like this

Free during beta