Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

ruoyi-vue-pro CRM Data Exposure through Missing Authorization

CVE-2026-57949 · published 4 months ago
Summary

A missing authorization check in ruoyi-vue-pro's CRM module allows authenticated users to access and view follow-up records, notes, file attachments, and scheduling information belonging to other users. This could potentially lead to unauthorized access to sensitive information. Ruoyi-vue-pro users should update to a version that includes the necessary authorization fix.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
yunai ruoyi-vue-pro <= 2026.05
Original advisory text
ruoyi-vue-pro - Missing Authorization in CRM Follow-up Record GET Endpoint
ruoyi-vue-pro through 2026.05, fixed in commit c779a47, contains a missing authorization vulnerability in the CRM module's GET /admin-api/crm/follow-up-record/get endpoint that allows authenticated users to read any follow-up record by iterating sequential numeric IDs. Attackers can exploit this by sending requests with arbitrary ID parameters to access other users' follow-up notes, file attachments, scheduling information, and business entity references without proper authorization checks.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published29 Jun 2026
Updated4 Nov 2026
First seen29 Jun 2026
Sources
CVE-2026-57949 · NVD
CVE-2026-57949 · MITRE
CVE-2026-57949 · OSV
Track software like this
Free during beta