Is CVE-2026-57949 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57949 being exploited in the wild.

How severe is CVE-2026-57949?

Medium severity, with a CVSS score of 6.5, published 29 June 2026.

Which products and versions are affected?

YunaiV Ruoyi-Vue-Pro through 2026.05.

Is there a fix for CVE-2026-57949?

A patch was published on 2026-06-29: Fix confirmed in commit c779a47 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57949 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-57949?

Check whether you run YunaiV Ruoyi-Vue-Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57949: Yunai ruoyi-vue-pro missing authorization in CRM follow-up record endpoint

CVE-2026-57949 · Severity: medium · CVSS 6.5 · Published 2026-06-29

ruoyi-vue-pro, a popular management system framework, contains a security flaw in its Customer Relationship Management (CRM) module. An authorized user can view sensitive follow-up notes, file attachments, and scheduling information belonging to other users by simply changing the ID number in a web request. This could lead to the exposure of confidential sales strategies, client interaction logs, and private business documents.

Technologies: YunaiV Ruoyi-Vue-Pro. Vendors: YunaiV.

Quick answers

Is CVE-2026-57949 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57949 being exploited in the wild.
How severe is CVE-2026-57949?: Medium severity, with a CVSS score of 6.5, published 29 June 2026.
Which products and versions are affected?: YunaiV Ruoyi-Vue-Pro through 2026.05.
Is there a fix for CVE-2026-57949?: A patch was published on 2026-06-29: Fix confirmed in commit c779a47 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57949 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-57949?: Check whether you run YunaiV Ruoyi-Vue-Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization vulnerability (CWE-862) exists in the GET /admin-api/crm/follow-up-record/get endpoint of ruoyi-vue-pro. The application fails to perform ownership or permission checks when retrieving follow-up records, relying solely on a sequential, auto-incrementing numeric ID. An authenticated attacker can exploit this by iterating through ID parameters to disclose sensitive CRM data, including follow-up notes, file URLs, and business entity references. The issue was addressed in commit c779a47 by implementing CrmPermissionLevelEnum validation.

Affected products

Yunai ruoyi-vue-pro through 2026.05

Timeline

2026-06-16: disclosed: Issue reported on GitHub by researcher George Chen
2026-06-29: advisory: NVD and VulnCheck advisories published
2026-06-29: patched: Fix confirmed in commit c779a47

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.