SZB-26169c7e29
RuoYi-Vue-Plus authorization bypass exposes other departments' users, EUVD-2026-114063
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- dromara
- Product
- RuoYi-Vue-Plus
- First seen
Summary
The EUVD record EUVD-2026-114063 describes an authorization bypass in SysUserServiceImpl.selectUserListByDept in RuoYi-Vue-Plus through 6.0.0, with a CVSS v3.1 score of 5.3. It says authenticated users can read users from other departments.
If you use dromara
Update RuoYi-Vue-Plus to a version later than 6.0.0
Review department-restricted role permissions
Audit user list access logs
What the sources say 1
· Mastodon: “RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authenticated users to read users of other departments.” Source