CVE-2026-122016 · Package
NO FIX YET
RuoYi-Vue, an open-source Java admin framework, has an improper privilege management flaw in its permission service, function SysPermissionService.getMenuPermission, where the perms argument is not handled safely. A remote attacker may be able to gain privileges beyond what their account allows.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running RuoYi-Vue up to version 3.9.2 that expose its admin interface to users or the network. The sources do not say which configurations are required, and the vendor did not respond to the disclosure, so no patch is stated.
Not affected if not-ruoyi-vue, version-above-3.9.2
Who cares admin-panel, java, ruoyi-vue, self-hosted
pom.xml or the project's version file.SysPermissionService.java file and the getMenuPermission function in the codebase.No fix yet, per the sources.
A vulnerability was determined in yangzongzhuan RuoYi-Vue up to 3.9.2. This issue affects the function SysPermissionService.getMenuPermission of the file SysPermissionService.java of the component Permission Service. This manipulation of the argument perms causes improper privilege management. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.