CVE-2026-122016

Name of the Vulnerable Software and Affected Versions yangzongzhuan RuoYi-Vue versions prior to 3.9.3

Description Improper privilege management occurs within the Permission Service component. A remote attacker can manipulate the perms argument in the getMenuPermission() function of the SysPermissionService.java file to bypass intended access controls.

Recommendations Update yangzongzhuan RuoYi-Vue to version 3.9.3 or later. As a temporary mitigation, restrict access to the getMenuPermission() function.