Live › vulnerability › CVE-2026-119647
RuoYi-Vue-Plus through 6.0.0 has an authorization bypass in the user list service, so a logged-in user with a department-restricted role can request any department ID. The response exposes usernames, nicknames, account status, last login IP and time, and remarks for users in other departments.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Teams that run RuoYi-Vue-Plus 6.0.0 or earlier as an internal admin system where some accounts hold the user-list permission under a department-restricted role. Exposure requires a valid account; deployments that only use unrestricted admin roles or have upgraded past the affected range are less exposed. The sources do not name a fixed version.
No product ranges from the sources yet.
pom.xml or the release tag; versions up to and including 6.0.0 are listed as affected.GET /system/user/list/dept/{deptId} and whether roles with system:user:list are department-scoped.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authenticated users to read users of other departments. Users holding system:user:list under a department-restricted role can request GET /system/user/list/dept/{deptId} with any department id to obtain usernames, nicknames, account status, last login IP and time, and remarks.
This page as .md · .json · in your agent: get_signal("CVE-2026-119647")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.