Skip to content
Sign in
5.3 Medium

CVE-2026-119647 RuoYi-Vue-Plus through 6.0.0 Data-Scope Bypass via /system/user/list/dept/{deptId}

Description

RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authenticated users to read users of other departments. Users holding system:user:list under a department-restricted role can request GET /system/user/list/dept/{deptId} with any department id to obtain usernames, nicknames, account status, last login IP and time, and remarks.

CVSS 4.0 detail

Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Exploitable remotely over the network, with an ordinary account and without any user action; the impact on data or service is limited.

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
Low
Interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Confidentiality of other systems
None
Integrity of other systems
None
Availability of other systems
None

Affected products and versions

Product Affected versions Fixed in
RuoYi-Vue-Plus 6.0 earliest → 6.0.0 No fix stated

Other CVEs of RuoYi-Vue-Plus

The 6 CVEs of RuoYi-Vue-Plus →
CVE-2026-110106 RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated… 2.3 Low CVE-2026-77795 A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2 5.3 Medium CVE-2026-58176 RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management endpoints under /workflow/task… 6.5 Medium CVE-2026-2819 A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.5.3 5.3 Medium
Track this CVE