| Titel | dromara RuoYi-Vue-Plus from 0 to 5.6.2 Incorrect Authorization |
|---|
| Beschreibung | The application implements coarse-grained authorization via `@SaCheckPermission` annotations on controller endpoints, which verify that the authenticated user holds the required role or menu permission (e.g., workflow:instance:query). However, no fine-grained data-ownership verification is performed at the service layer. This allows a user with a given role permission to access or modify resources belonging to other users by manipulating resource identifiers (e.g., `businessId`, `instanceId`, `definitionId`) supplied in the request path or body.
Root Cause
The authorization model conflates function-level access (whether a user may enter a feature) with data-level access (whether a user may operate on a specific record). The @SaCheckPermission annotation answers only the first question. Service-layer methods accept resource identifiers as parameters without verifying that the current user—obtainable via LoginHelper.getUserId() or LoginHelper.getUserIdStr()—is the owner (typically matched against the record's createBy column) or an assigned participant of the target resource.
Impact
A malicious authenticated user who possesses a given functional permission can perform the corresponding operation on any record within the system, regardless of ownership. This constitutes horizontal privilege escalation: reading, modifying, or deleting data belonging to peer users within the same tenant.
|
|---|
| Quelle | ⚠️ https://github.com/SunRisexyz/Vul-of-Ruoyi/issues/1 |
|---|
| Benutzer | Jarv1s123 (UID 99572) |
|---|
| Einreichung | 06.07.2026 13:10 (vor 2 Monaten) |
|---|
| Moderieren | 21.08.2026 15:14 (2 months later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 394113 [Dromara RuoYi-Vue-Plus bis 5.6.2 Workflow Endpoint erweiterte Rechte] |
|---|
| Punkte | 20 |
|---|