Broken Access Control in Ruoyi Vue Pro Affecting Sale Order Management

CVE-2026-57950

What is CVE-2026-57950?

The Ruoyi Vue Pro framework suffers from a broken access control vulnerability in the ErpSaleOrderController. This flaw allows users with shipment-level permissions to interact with sensitive sale order operations, including the ability to create, update, delete, and read orders. The erroneous enforcement of the erp:sale-out permissions over the intended erp:sale-order namespace creates a pathway for unauthorized access, potentially leading to severe financial implications. The issue has been addressed in commit 5d1fd70 with a patch aimed at reinforcing correct permission checks.

References