PT-2026-98260 · Yunaiv · Ruoyi-Vue-Pro
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
YunaiV/zhijiantianya ruoyi-vue-pro versions prior to 2026.09
Description
Improper authorization exists in the Demo-order Payment Callback Handler component. A remote attacker can manipulate the
ID argument within the updateDemoOrderPaid() function of the PayDemoOrderController.java file to bypass authorization controls.Recommendations
Update YunaiV/zhijiantianya ruoyi-vue-pro to a version later than 2026.08.
As a temporary workaround, restrict access to the
updateDemoOrderPaid() function until a patch is applied.Fix
Improper Authorization
Incorrect Privilege Assignment
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Ruoyi-Vue-Pro