CVE-2026-122016 Details
Description
A vulnerability was determined in yangzongzhuan RuoYi-Vue up to 3.9.2. This issue affects the function SysPermissionService.getMenuPermission of the file SysPermissionService.java of the component Permission Service. This manipulation of the argument perms causes improper privilege management. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability affecting Yangzongzhuan RuoYi-Vue versions through 3.9.2 has been identified in the Permission Service component. The issue arises in the SysPermissionService.getMenuPermission function within SysPermissionService.java. This vulnerability allows for improper privilege management by manipulating the 'perms' argument, potentially leading to unauthorized access to system functionalities. The vulnerability can be exploited remotely.
To address this vulnerability, it is recommended to implement a check that prevents the use of reserved wildcard permissions in the menu 'perms' field. This can be done by adding a validation step in the menu service before the permissions are saved, ensuring that such reserved values are not accepted.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/yangzongzhuan/RuoYi-Vue/ | [email protected] | ProductVendor |
| https://github.com/yangzongzhuan/RuoYi-Vue/issues/206 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://vuldb.com/cve/CVE-2026-122016 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1024636 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/431084 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/431084/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-269 | Improper Privilege Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| yangzongzhuan RuoYi-Vue | <= 3.9.2 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | New CVE Received | [email protected] |