| शीर्षक | dromara RuoYi-Vue-Plus from 0 to 5.6.2 Incorrect Authorization |
|---|
| विवरण | The application implements coarse-grained authorization via `@SaCheckPermission` annotations on controller endpoints, which verify that the authenticated user holds the required role or menu permission (e.g., workflow:instance:query). However, no fine-grained data-ownership verification is performed at the service layer. This allows a user with a given role permission to access or modify resources belonging to other users by manipulating resource identifiers (e.g., `businessId`, `instanceId`, `definitionId`) supplied in the request path or body.
Root Cause
The authorization model conflates function-level access (whether a user may enter a feature) with data-level access (whether a user may operate on a specific record). The @SaCheckPermission annotation answers only the first question. Service-layer methods accept resource identifiers as parameters without verifying that the current user—obtainable via LoginHelper.getUserId() or LoginHelper.getUserIdStr()—is the owner (typically matched against the record's createBy column) or an assigned participant of the target resource.
Impact
A malicious authenticated user who possesses a given functional permission can perform the corresponding operation on any record within the system, regardless of ownership. This constitutes horizontal privilege escalation: reading, modifying, or deleting data belonging to peer users within the same tenant.
|
|---|
| स्रोत | ⚠️ https://github.com/SunRisexyz/Vul-of-Ruoyi/issues/1 |
|---|
| उपयोगकर्ता | Jarv1s123 (UID 99572) |
|---|
| सबमिशन | 06/07/2026 01:10 PM (2 महीनों पहले) |
|---|
| संयम | 21/08/2026 03:14 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 394113 [Dromara RuoYi-Vue-Plus तक 5.6.2 Workflow Endpoint अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|