Authorization Bypass in RuoYi-Vue-Plus Allows Access to User Data Across Departments

CVE-2026-119647

What is CVE-2026-119647?

RuoYi-Vue-Plus versions up to 6.0.0 are susceptible to an authorization bypass vulnerability that enables authenticated users to access sensitive user information from other departments. Specifically, users with the 'system:user:list' privilege can exploit this vulnerability by sending GET requests to the endpoint '/system/user/list/dept/{deptId}' with any department ID. This flaw allows them to retrieve usernames, nicknames, account status, last login IP, last login time, and additional remarks, potentially leading to unauthorized disclosure of user data across departmental boundaries.

References