# CVE-2026-57949: Yunai ruoyi-vue-pro missing authorization in CRM follow-up record endpoint

Source: https://junglewise.ai/threats/cve-2026-57949-yunai-ruoyi-vue-pro-missing-authorization-in-crm-follow-up-record  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-29. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2026-57949 · Severity: medium · CVSS 6.5 · Published 2026-06-29

ruoyi-vue-pro, a popular management system framework, contains a security flaw in its Customer Relationship Management (CRM) module. An authorized user can view sensitive follow-up notes, file attachments, and scheduling information belonging to other users by simply changing the ID number in a web request. This could lead to the exposure of confidential sales strategies, client interaction logs, and private business documents.

Technologies: [YunaiV Ruoyi-Vue-Pro](https://junglewise.ai/threats/technologies/ruoyi-vue-pro). Vendors: [YunaiV](https://junglewise.ai/threats/vendors/yunaiv).

## Quick answers

**Is CVE-2026-57949 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57949 being exploited in the wild.

**How severe is CVE-2026-57949?** Medium severity, with a CVSS score of 6.5, published 29 June 2026.

**Which products and versions are affected?** YunaiV Ruoyi-Vue-Pro through 2026.05.

**Is there a fix for CVE-2026-57949?** A patch was published on 2026-06-29: Fix confirmed in commit c779a47 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57949 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-57949?** Check whether you run YunaiV Ruoyi-Vue-Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization vulnerability (CWE-862) exists in the GET /admin-api/crm/follow-up-record/get endpoint of ruoyi-vue-pro. The application fails to perform ownership or permission checks when retrieving follow-up records, relying solely on a sequential, auto-incrementing numeric ID. An authenticated attacker can exploit this by iterating through ID parameters to disclose sensitive CRM data, including follow-up notes, file URLs, and business entity references. The issue was addressed in commit c779a47 by implementing CrmPermissionLevelEnum validation.

## Affected products

- Yunai ruoyi-vue-pro through 2026.05

## Timeline

- 2026-06-16: disclosed: Issue reported on GitHub by researcher George Chen
- 2026-06-29: advisory: NVD and VulnCheck advisories published
- 2026-06-29: patched: Fix confirmed in commit c779a47

## References

- [https://github.com/YunaiV/ruoyi-vue-pro/commit/c779a476617c58a38904191094d22df254b42542](https://github.com/YunaiV/ruoyi-vue-pro/commit/c779a476617c58a38904191094d22df254b42542)
- [https://github.com/YunaiV/ruoyi-vue-pro/issues/1159](https://github.com/YunaiV/ruoyi-vue-pro/issues/1159)
- [https://www.vulncheck.com/advisories/ruoyi-vue-pro-missing-authorization-in-crm-follow-up-record-get-endpoint](https://www.vulncheck.com/advisories/ruoyi-vue-pro-missing-authorization-in-crm-follow-up-record-get-endpoint)

## Related threats

- [YunaiV ruoyi-vue-pro authentication bypass in SMS verification](https://junglewise.ai/threats/cve-2026-116006-a-vulnerability-was-detected-in-yunaiv-zhijiantianya-ruoyi-vue)
- [ruoyi-vue-pro server-side request forgery in AI image service](https://junglewise.ai/threats/cve-2026-110610-ruoyi-vue-pro-through-2026-09-contains-a-server-side-request)
- [YunaiV ruoyi-vue-pro open redirect in OAuth2 Client](https://junglewise.ai/threats/cve-2026-97325-a-security-flaw-has-been-discovered-in-yunaiv-zhijiantianya-ruoyi)
- [RuoYi-Vue-Pro path traversal in file upload](https://junglewise.ai/threats/cve-2026-97323-a-vulnerability-was-determined-in-yunaiv-zhijiantianya-ruoyi-vue)
- [RuoYi-Vue-Pro file upload cross-site scripting in FileController](https://junglewise.ai/threats/cve-2026-97322-a-vulnerability-was-found-in-yunaiv-zhijiantianya-ruoyi-vue-pro)