Is CVE-2026-108825 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108825 being exploited in the wild.

How severe is CVE-2026-108825?

Medium severity, with a CVSS score of 5.4, published 12 October 2026.

Which products and versions are affected?

Yangzongzhuan RuoYi up to 4.8.3.

Is there a fix for CVE-2026-108825?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-108825 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-108825?

Check whether you run Yangzongzhuan RuoYi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108825: RuoYi privilege escalation in role authorization

CVE-2026-108825 · Severity: medium · CVSS 5.4 · Published 2026-10-12

RuoYi is a role-based access control system used in enterprise applications. A flaw in the role authorization function allows attackers to manipulate role identifiers and gain unauthorized administrative access. An attacker with basic network access can escalate their privileges without authentication, potentially gaining full control of the application.

Vendors: Yangzongzhuan.

Quick answers

Is CVE-2026-108825 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108825 being exploited in the wild.
How severe is CVE-2026-108825?: Medium severity, with a CVSS score of 5.4, published 12 October 2026.
Which products and versions are affected?: Yangzongzhuan RuoYi up to 4.8.3.
Is there a fix for CVE-2026-108825?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-108825 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-108825?: Check whether you run Yangzongzhuan RuoYi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The checkRoleAllowed function in /system/role/authDataScope fails to properly validate the roleKey parameter, enabling privilege escalation through argument manipulation. The vulnerability requires network access but no prior authentication. Attackers can exploit this to bypass role-based access controls and assume higher privileges within the system.

Affected products

yangzongzhuan RuoYi up to 4.8.3

Timeline

2026-10-12: disclosed: Exploit details published publicly
2026-10-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.