CVE-2026-119647 in RuoYi-Vue-Plus
Summary
by MITRE • 10/30/2026
RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authenticated users to read users of other departments. Users holding system:user:list under a department-restricted role can request GET /system/user/list/dept/{deptId} with any department id to obtain usernames, nicknames, account status, last login IP and time, and remarks.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in RuoYi-Vue-Plus versions up to 6.0.0 represents a critical authorization bypass flaw within the SysUserServiceImpl.selectUserListByDept method. This security defect allows authenticated users who possess specific role permissions to access sensitive user data belonging to other departments, effectively circumventing intended departmental isolation controls. The core technical issue stems from an improper implementation of object-level or resource-level access control mechanisms. While the application correctly restricts certain actions based on roles and departments for many endpoints, this particular endpoint fails to validate whether the requesting user belongs to the specified department ID provided in the request path parameter. Consequently, any authenticated user with the system:user:list permission can manipulate the deptId parameter to query data from arbitrary departments within the organization's hierarchy.
From a technical perspective, the flaw lies in the backend logic that processes GET requests directed at /system/user/list/dept/{deptId}. The application accepts this input and uses it to filter database queries without cross-referencing against the authenticated user’s actual departmental affiliation or role-based access control lists. This lack of server-side validation means that the authorization check is either missing entirely for this specific resource path or relies on client-supplied data rather than enforcing strict identity verification. The vulnerability exploits a common pattern in web application development where developers assume that if an endpoint requires authentication, it inherently enforces proper authorization boundaries. However, without explicit checks ensuring that the user’s assigned department matches the requested deptId, the system fails to enforce multi-tenancy or hierarchical data isolation principles effectively.
The operational impact of this vulnerability is significant for organizations relying on RuoYi-Vue-Plus for internal management systems. Attackers can enumerate usernames, nicknames, account statuses, last login IP addresses and times, and remarks across all departments in the system. This information disclosure facilitates further attacks such as targeted phishing campaigns, credential stuffing using known valid accounts, or social engineering based on detailed user profiles. The exposure of last login IPs may also aid attackers in mapping network infrastructure or identifying high-value targets who are currently active. Since this requires only basic authentication and a specific permission set that is often granted to administrative assistants or department heads for operational purposes, the attack surface is relatively wide among legitimate users who might inadvertently exploit the flaw or be coerced into doing so by an insider threat actor.
This vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting failures in enforcing proper authorization checks on sensitive resources. It also maps to MITRE ATT&CK technique T1078 Valid Accounts, as it leverages legitimate credentials and permissions to access unauthorized data. Furthermore, the ability to enumerate user information across organizational boundaries relates to CWE-200 Information Exposure through Diagnostic Information or Data Leakage. The lack of proper input validation on resource identifiers corresponds closely with CWE-639 Authorization Bypass Through User-Controlled Key. These classifications highlight that the root cause is not a complex cryptographic failure but rather a fundamental oversight in implementing robust access control policies within the application logic.
To mitigate this vulnerability, immediate patching to version 6.0.1 or later is recommended if available from the official vendor. For environments where upgrading is not immediately feasible, administrators should implement compensating controls at the network level by restricting access to sensitive endpoints via Web Application Firewalls that inspect request parameters for unauthorized department IDs relative to user profiles. Additionally, developers must review and harden all authorization logic in service implementations to ensure that every data retrieval operation validates the requester’s identity against the requested resource scope. Implementing strict role-based access control checks within the selectUserListByDept method is essential. This involves verifying that the authenticated user’s department ID matches or falls under the hierarchy of the deptId parameter before returning any results. Regular security code reviews and automated static analysis tools configured to detect authorization bypass patterns should be integrated into the development lifecycle to prevent similar flaws in future releases.