CVE-2025-10276: Ruoyi-vue-pro Auth Bypass Vulnerability

CVE-2025-10276 Overview

CVE-2025-10276 is an improper authorization vulnerability [CWE-266] affecting YunaiV ruoyi-vue-pro versions up to 2025.09. The flaw resides in the /crm/contract/transfer endpoint, where manipulation of the id and newOwnerUserId parameters allows authenticated attackers to transfer CRM contracts they should not control. Remote exploitation is possible over the network with low privileges and no user interaction. The exploit has been disclosed publicly. The vendor was contacted prior to disclosure but did not respond.

Critical Impact
Authenticated remote attackers can reassign contract ownership inside the CRM module by exploiting missing authorization checks on the contract transfer endpoint.

Affected Products

iocoder ruoyi-vue-pro up to and including version 2025.09
CRM module exposing the /crm/contract/transfer route
Deployments using the default authorization model for contract ownership transfer

Discovery Timeline

2025-09-12 - CVE-2025-10276 published to the National Vulnerability Database (NVD)
2026-04-29 - Last updated in the NVD database

Technical Details for CVE-2025-10276

Vulnerability Analysis

The vulnerability stems from missing authorization enforcement on the /crm/contract/transfer endpoint inside the CRM module of ruoyi-vue-pro. The handler accepts the id parameter, which references a contract record, and the newOwnerUserId parameter, which designates the user to receive ownership. The application processes the transfer without verifying that the requesting user actually owns or has rights to manage the referenced contract. Any authenticated user can therefore reassign contracts belonging to other users to themselves or to a chosen account. This breaks the tenant-style separation expected from a CRM application and creates conditions for data theft and business logic abuse.

Root Cause

The defect is classified under [CWE-266] Incorrect Privilege Assignment. The contract transfer service layer trusts the supplied id parameter and applies the new owner change without an authorization predicate that compares the authenticated principal to the resource owner or role scope. Server-side checks for contract membership, sales team boundaries, and administrative scope are absent on this code path.

Attack Vector

An attacker authenticates to the application using any valid low-privilege account. The attacker then issues a crafted HTTP request to /crm/contract/transfer with a target contract id and an attacker-controlled newOwnerUserId. Because no authorization check ties the requester to the contract, the server applies the change and the attacker becomes the owner of the targeted record. The full request format and parameter handling are documented in the public references listed under the VulDB advisory and the CNBlogs analysis.

Detection Methods for CVE-2025-10276

Indicators of Compromise

HTTP POST requests to /crm/contract/transfer originating from user accounts that do not normally manage CRM contracts.
Sudden changes to the ownerUserId field on CRM contract records without a corresponding administrative ticket or workflow event.
Bursts of contract transfers from a single session ID or token within a short time window.

Detection Strategies

Audit application logs for calls to the contract transfer endpoint and correlate the acting user against the contract's prior owner.
Compare the newOwnerUserId value in each request against the authenticated session user to flag self-assignment patterns.
Enable database-level auditing on the CRM contract table to record every ownership change with the originating user ID.

Monitoring Recommendations

Forward web access logs and application audit logs to a centralized SIEM for correlation across user sessions.
Alert on any non-administrative account that performs more than a small threshold of contract ownership changes per day.
Track outbound contract exports following ownership changes, as data exfiltration commonly follows unauthorized reassignment.

How to Mitigate CVE-2025-10276

Immediate Actions Required

Restrict network access to the /crm/contract/transfer route to trusted administrators using a reverse proxy or WAF rule until a patch is applied.
Review CRM contract ownership history for unauthorized reassignments performed since the application was first deployed.
Rotate credentials of any low-privilege account that shows evidence of exploiting the endpoint.
Apply an interim authorization filter at the API gateway that verifies the requester owns the referenced contract.

Patch Information

The vendor did not respond to the disclosure, and no official patch is referenced in the NVD entry at the time of writing. Operators running ruoyi-vue-pro 2025.09 or earlier should monitor the project repository for an upstream fix and implement compensating controls. Refer to the VulDB entry for CVE-2025-10276 for updated remediation status.

Workarounds

Add a server-side authorization check in the contract transfer controller that validates the authenticated user against the contract's current owner or an admin role before processing the transfer.
Deploy a WAF rule that blocks requests to /crm/contract/transfer where the JSON body's newOwnerUserId does not match the session user or an allowlisted administrator group.
Disable the contract transfer feature in the UI for non-administrative roles and enforce the restriction in the backend role-based access control configuration.

bash

# Example WAF rule (ModSecurity) to restrict the vulnerable endpoint
SecRule REQUEST_URI "@streq /crm/contract/transfer" \
    "id:1010276,phase:1,deny,status:403,\
     chain,msg:'Block unauthorized CRM contract transfer (CVE-2025-10276)'"
    SecRule REQUEST_HEADERS:X-User-Role "!@pm admin crm-manager"