Insecure Role Assignment in RuoYi v4.8.0 by Yangzongzhuan

CVE-2024-57438

What is CVE-2024-57438?

In RuoYi version 4.8.0, a security flaw related to insecure permissions enables authenticated users to escalate their privileges by assigning themselves roles that grant higher access levels. This vulnerability poses a significant risk, allowing unauthorized access to sensitive functionalities that should be restricted to higher-level users. It underscores the importance of implementing strict permission checks to mitigate the risk of unauthorized privilege escalation.

References