Improper Authorization Vulnerability in YunaiV Ruoyi-Vue-Pro

CVE-2025-10276

What is CVE-2025-10276?

A security vulnerability has been identified in the YunaiV ruoyi-vue-pro platform prior to version 2025.09, affecting the functionality of the /crm/contract/transfer endpoint. This issue arises from improper handling of arguments tied to user IDs, specifically the id and newOwnerUserId parameters, allowing attackers to bypass authorization checks. Such exploitation could enable unauthorized access to sensitive data and functions within the application. Despite early notification efforts to the vendor regarding this significant flaw, no response was received. Organizations using affected versions are advised to assess their exposure and take appropriate measures to mitigate potential risks.

References