Description
Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their scope.
Published: 2026-01-23
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Jan 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Ruoyi
Ruoyi ruoyi
CPEs cpe:2.3:a:ruoyi:ruoyi:4.8.1:*:*:*:*:*:*:*
cpe:2.3:a:ruoyi:ruoyi:4.8.2:*:*:*:*:*:*:*
Vendors & Products Ruoyi
Ruoyi ruoyi

Mon, 26 Jan 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Y Project
Y Project ruoyi
Vendors & Products Y Project
Y Project ruoyi

Fri, 23 Jan 2026 20:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-862
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Jan 2026 19:00:00 +0000

Type Values Removed Values Added
Description Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their scope.
References

Subscriptions

Ruoyi Ruoyi
Y Project Ruoyi
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-01-23T19:39:50.348Z

Reserved: 2026-01-09T00:00:00.000Z

Link: CVE-2025-70985

cve-icon Vulnrichment

Updated: 2026-01-23T19:39:13.870Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-23T19:15:53.907

Modified: 2026-01-30T21:27:40.100

Link: CVE-2025-70985

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-01-26T11:54:17Z

Weaknesses