RuoYi-Vue-Plus through 6.0.0 Data-Scope Bypass via /system/user/list/dept/{deptId}
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fix or patch referenced
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
RuoYi-Vue-Plus, a Java-based web administration framework, is affected by this vulnerability. An authenticated user with a department-restricted role can exploit a flaw in its user listing feature to view account details, such as usernames, status, and login records, for users in departments they should not have access to.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authenticated users to read users of other departments. Users holding system:user:list under a department-restricted role can request GET /system/user/list/dept/{deptId} with any department id to obtain usernames, nicknames, account status, last login IP and time, and remarks.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- dromara RuoYi-Vue-Plus
through 6.0.0