Executive brief
A security flaw exists in the Enterprise Resource Planning (ERP) module of ruoyi-vue-pro, a popular management system framework. The system incorrectly uses the same security permissions for both physical shipping tasks and financial sales orders. This allows lower-level staff, such as warehouse workers, to view, modify, or delete sensitive sales contracts and financial records they should not be able to access.
Technical details
A broken access control vulnerability (CWE-863) exists in the ErpSaleOrderController due to the use of an incorrect permission namespace. The controller enforces the 'erp:sale-out' namespace (intended for physical outbound shipments) instead of the 'erp:sale-order' namespace (intended for sales contracts). An authenticated attacker with low-privileged shipment permissions can exploit this collision to perform unauthorized CREATE, READ, UPDATE, and DELETE operations on financially sensitive sale orders. The vulnerability is reachable over the network and does not require user interaction. A fix is available in commit 5d1fd70.
Affected products
- YunaiV ruoyi-vue-pro through 2026.05
Timeline
- 2026-06-16: disclosed: Issue reported on GitHub
- 2026-06-29: advisory: NVD and VulnCheck advisory published
- 2026-06-29: patched: Fix identified in commit 5d1fd70