Missing Authorization Vulnerability in Ruoyi-Vue-Pro CRM Module

CVE-2026-57949

What is CVE-2026-57949?

The Ruoyi-Vue-Pro CRM module has a missing authorization vulnerability in the GET /admin-api/crm/follow-up-record/get endpoint. This issue allows authenticated users to exploit the system by sequentially sending requests with numeric IDs. By manipulating these parameters, attackers can gain unauthorized access to sensitive information such as follow-up notes, file attachments, and business entity references belonging to other users without any proper authorization checks. This vulnerability poses significant risks to user privacy and data integrity, highlighting the importance of robust access controls within the application.

References