CVE-2026-57949

Name of the Vulnerable Software and Affected Versions ruoyi-vue-pro versions prior to 2026.05

Description The CRM module contains a missing authorization flaw in the 'GET /admin-api/crm/follow-up-record/get' endpoint. Authenticated users can access any follow-up record by iterating through sequential numeric IDs. By sending requests with arbitrary id parameters, an attacker can read other users' follow-up notes, file attachments, scheduling information, and business entity references.

Recommendations Update ruoyi-vue-pro to the version containing commit c779a47. As a temporary mitigation, restrict access to the 'GET /admin-api/crm/follow-up-record/get' endpoint.