Executive brief
ruoyi-vue-pro, a popular management system framework, contains a security flaw in its Customer Relationship Management (CRM) module. An authorized user can view sensitive follow-up notes, file attachments, and scheduling information belonging to other users by simply changing the ID number in a web request. This could lead to the exposure of confidential sales strategies, client interaction logs, and private business documents.
Technical details
A missing authorization vulnerability (CWE-862) exists in the GET /admin-api/crm/follow-up-record/get endpoint of ruoyi-vue-pro. The application fails to perform ownership or permission checks when retrieving follow-up records, relying solely on a sequential, auto-incrementing numeric ID. An authenticated attacker can exploit this by iterating through ID parameters to disclose sensitive CRM data, including follow-up notes, file URLs, and business entity references. The issue was addressed in commit c779a47 by implementing CrmPermissionLevelEnum validation.
Affected products
- Yunai ruoyi-vue-pro through 2026.05
Timeline
- 2026-06-16: disclosed: Issue reported on GitHub by researcher George Chen
- 2026-06-29: advisory: NVD and VulnCheck advisories published
- 2026-06-29: patched: Fix confirmed in commit c779a47