CVE-2026-119647

Impact

RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authenticated users to read users of other departments. Users holding system:user:list under a department-restricted role can request GET /system/user/list/dept/{deptId} with any department id to obtain usernames, nicknames, account status, last login IP and time, and remarks.

Affected products

Versions were read from the advisory text. No structured product data has been published for this record yet.

Weakness classification

References

• NVD record
• CVE.org record
• https://github.com/dromara/RuoYi-Vue-Plus
• https://github.com/dromara/RuoYi-Vue-Plus/blob/v6.0.0/ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/controller/system/SysUserController.java#L352-L356
• https://github.com/dromara/RuoYi-Vue-Plus/blob/v6.0.0/ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/service/impl/SysUserServiceImpl.java#L555-L560
• https://github.com/dromara/RuoYi-Vue-Plus/commit/a8b1bea7b7a4ca260172cf74fbf4ea7763092996
• https://github.com/dromara/RuoYi-Vue-Plus/issues/60
• https://hackmd.io/@hieuPenguinnn/ruoyi-vue-plus-user-list-by-dept-datascope-bypass
• https://www.vulncheck.com/advisories/ruoyi-vue-plus-through-6.0.0-data-scope-bypass-via-system-user-list-dept-deptid