High · 7.5 CVE-2025-46174 EUVD-2025-199729GHSA-7rvm-47hf-m85c

Ruoyi v4.8.0 vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the resetPwd Method of SysUs…

Published Nov 26, 2025 · Updated Dec 4, 2025 · Assigned by mitre

Description

Ruoyi v4.8.0 vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the resetPwd Method of SysUserController.java.

References

https://gitee.com/y_project/RuoYi/issues/IC1JZR
https://gitee.com/y_project/RuoYi/commit/ea4af7a8cf54393b11d3d286e0aaeb3df8a9aaef
https://gist.github.com/Han-tj/29543ce0dae8cbb3bcbedca3390844a9