PT-2026-53668 · Unknown · Ruoyi-Vue-Pro
CVSS v4.0
8.6
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
ruoyi-vue-pro versions prior to 2026.05
Description
Broken access control exists in the
ErpSaleOrderController due to incorrect permission namespace enforcement. Attackers possessing erp:sale-out permissions can perform unauthorized create, update, delete, and read operations on financially sensitive sale orders because the controller incorrectly enforces the erp:sale-out namespace instead of the required erp:sale-order namespace.Recommendations
Update ruoyi-vue-pro to the version containing commit 5d1fd70.
Exploit
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ruoyi-Vue-Pro