CVE-2025-28408

Name of the Vulnerable Software and Affected Versions RUoYi version 4.8.0

Description The issue allows a remote attacker to escalate privileges. This is achieved via the selectDeptTree method of the "/selectDeptTree/{deptId}" endpoint, which does not properly validate the deptId parameter.

Recommendations For RUoYi version 4.8.0, as a temporary workaround, consider restricting access to the /selectDeptTree/{deptId} endpoint until a patch is available. Additionally, avoid using the deptId parameter in the affected endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.