Improper Privilege Management in RuoYi-Vue Component of yangzongzhuan
CVE-2026-122016

5.3MEDIUM

Key Information:

Vendor

Yangzongzhuan

Status
Ruoyi-vue
Vendor
CVE Published:
4 November 2026

What is CVE-2026-122016?

A security vulnerability has been identified in the RuoYi-Vue product from yangzongzhuan, specifically affecting the SysPermissionService component. The flaw exists in the function SysPermissionService.getMenuPermission located in SysPermissionService.java, where improper handling of the 'perms' argument can lead to flaws in privilege management. This issue allows remote attackers to exploit the vulnerability, potentially gaining unauthorized access or control. The vendor was notified of the issue prior to disclosure but did not provide a response.

Affected Version(s)

RuoYi-Vue 3.9.0

RuoYi-Vue 3.9.1

RuoYi-Vue 3.9.2

References

https://vuldb.com/vuln/431084
vdb-entrytechnical-description
https://vuldb.com/vuln/431084/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-122016
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

OMrYangO (VulDB User)
VulDB CNA Team
.