CVE-2026-108825 Details
Description
A vulnerability has been found in yangzongzhuan RuoYi up to 4.8.3. This affects the function checkRoleAllowed of the file /system/role/authDataScope. Such manipulation of the argument roleKey leads to improper privilege management. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A privilege escalation vulnerability exists in Yangzongzhuan RuoYi versions through 4.8.3. The issue arises in the role management functionality, specifically within the 'checkRoleAllowed' method of the 'SysRoleServiceImpl' class. The vulnerability allows authenticated low-privilege users to manipulate the 'roleKey' parameter when updating role data scopes. This manipulation bypasses proper privilege management and can be exploited remotely. The vulnerability has been publicly disclosed, but the vendor has not responded to reports.
To address this vulnerability, reject comma injections in role keys, disallow reserved names like 'admin' in ordinary roles, and enforce uniqueness on final authorization tokens. Additionally, add a regression test to ensure non-admin users cannot persist 'roleKey' values that include admin rights.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Bob-wentao/security-report-for-ruoyi-role-key-authorization/blob/main/security-report-ruoyi-4.8.3-role-key-authorization.md | [email protected] | ExploitTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-108825 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/967058 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/416601 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/416601/cti | [email protected] | AdvisoryContent Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-269 | Improper Privilege Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| yangzongzhuan RuoYi | 4.8.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |