| عنوان | dromara RuoYi-Vue-Plus from 0 to 5.6.2 Incorrect Authorization |
|---|
| الوصف | The application implements coarse-grained authorization via `@SaCheckPermission` annotations on controller endpoints, which verify that the authenticated user holds the required role or menu permission (e.g., workflow:instance:query). However, no fine-grained data-ownership verification is performed at the service layer. This allows a user with a given role permission to access or modify resources belonging to other users by manipulating resource identifiers (e.g., `businessId`, `instanceId`, `definitionId`) supplied in the request path or body.
Root Cause
The authorization model conflates function-level access (whether a user may enter a feature) with data-level access (whether a user may operate on a specific record). The @SaCheckPermission annotation answers only the first question. Service-layer methods accept resource identifiers as parameters without verifying that the current user—obtainable via LoginHelper.getUserId() or LoginHelper.getUserIdStr()—is the owner (typically matched against the record's createBy column) or an assigned participant of the target resource.
Impact
A malicious authenticated user who possesses a given functional permission can perform the corresponding operation on any record within the system, regardless of ownership. This constitutes horizontal privilege escalation: reading, modifying, or deleting data belonging to peer users within the same tenant.
|
|---|
| المصدر | ⚠️ https://github.com/SunRisexyz/Vul-of-Ruoyi/issues/1 |
|---|
| المستخدم | Jarv1s123 (UID 99572) |
|---|
| ارسال | 06/07/2026 01:10 PM (2 أشهر منذ) |
|---|
| الاعتدال | 21/08/2026 03:14 PM (2 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 394113 [Dromara RuoYi-Vue-Plus حتى 5.6.2 Workflow Endpoint تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|