CVE-2026-122016
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In yangzongzhuan RuoYi-Vue up to 3.9.2, the SysPermissionService.getMenuPermission function in SysPermissionService.java of the Permission Service component allows manipulation of the perms argument leading to improper privilege management. The attack can be initiated remotely; the vendor did not respond to the disclosure.
Risk Assessment
May enable privilege escalation and unauthorized access to administrative functions, posing a serious threat to the system.
Recommendation
Restrict access to administrative interfaces and enforce server-side validation of the perms argument, since the vendor has not released a fix.
Other vulnerabilities in RuoYi-Vue
See all- CVE-2026-76576Medium
RuoYi-Vue up to version 3.9.2 has a path traversal vulnerability in the fileDownload/resourceDownload function in CommonController.java. Manipulation of the fileName/resource argument allows remote attack, and the exploit has been made public.
- CVE-2026-9374Medium
A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2 in the FileUploadUtils.upload function in the /common/upload file of the Common Upload Endpoint component. Manipulation leads to unrestricted upload. The attack can be launched remotely. The vendor did not respond.
Original NVD description (English source)
A vulnerability was determined in yangzongzhuan RuoYi-Vue up to 3.9.2. This issue affects the function SysPermissionService.getMenuPermission of the file SysPermissionService.java of the component Permission Service. This manipulation of the argument perms causes improper privilege management. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS