CVE-2025-10384: RuoYi Authorization Bypass Vulnerability

CVE-2025-10384 Overview

CVE-2025-10384 is an improper authorization vulnerability [CWE-266] in yangzongzhuan RuoYi versions up to 4.8.1. The flaw resides in the /system/role/authUser/cancelAll endpoint within the Role Handler component. Authenticated attackers can manipulate the roleId and userIds parameters to perform unauthorized actions across role-user associations. The exploit has been publicly disclosed. The vendor was contacted prior to publication but did not respond.

Critical Impact

Remote authenticated attackers can bypass authorization checks on the RuoYi Role Handler to cancel role-user associations they should not be able to modify, affecting integrity and availability of role assignments.

Affected Products

• yangzongzhuan RuoYi versions up to and including 4.8.1
• RuoYi system/role/authUser/cancelAll endpoint (Role Handler component)
• Downstream applications built on the RuoYi rapid-development framework

Discovery Timeline

• 2025-09-13 - CVE-2025-10384 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10384

Vulnerability Analysis

RuoYi is a Java-based rapid-development framework widely used for building enterprise management systems in China. The Role Handler exposes the /system/role/authUser/cancelAll endpoint, which cancels the authorization of multiple users assigned to a role. The endpoint accepts a roleId parameter and a userIds list. It fails to verify that the calling user has legitimate authority over the target role or the target users before performing the cancellation.

Because the endpoint enforces authentication but not sufficient authorization, any low-privileged authenticated user can invoke the operation against arbitrary roleId and userIds values. This weakness is classified as [CWE-266] Incorrect Privilege Assignment. Successful abuse alters role membership, breaking least-privilege boundaries and disrupting access to protected functionality within applications built on RuoYi.

Root Cause

The controller method backing cancelAll performs data manipulation without invoking a permission check against the authenticated principal's role scope. Authorization annotations and service-layer guards that protect related administrative endpoints are missing or inconsistently applied on this specific handler, leaving business-logic access control incomplete.

Attack Vector

Exploitation requires network access to the RuoYi application and a valid authenticated session with low privileges. The attacker issues a crafted HTTP request to /system/role/authUser/cancelAll supplying the target roleId and a list of userIds. No user interaction is required. Refer to the CNBlogs Analysis Article and the VulDB entry for additional technical context.

Detection Methods for CVE-2025-10384

Indicators of Compromise

• HTTP POST requests to /system/role/authUser/cancelAll originating from user accounts that do not hold role-administration privileges.
• Unexpected removal of user-role associations recorded in the sys_user_role table without a corresponding administrative audit entry.
• Bursts of cancelAll requests containing varied roleId values from a single session.

Detection Strategies

• Instrument the RuoYi application logs to capture caller identity, roleId, and userIds for every invocation of /system/role/authUser/cancelAll.
• Correlate role-cancellation events against the caller's assigned permissions to identify authorization mismatches.
• Alert when non-administrative accounts successfully invoke role-management endpoints.

Monitoring Recommendations

• Forward RuoYi application and web server logs to a centralized SIEM for behavioral analytics on privileged endpoints.
• Track baseline call rates for /system/role/authUser/* endpoints and alert on deviations.
• Review database audit logs for unexpected DELETE operations against user-role mapping tables.

How to Mitigate CVE-2025-10384

Immediate Actions Required

• Restrict network access to the RuoYi administrative endpoints under /system/role/ via reverse-proxy allow-lists or web application firewall (WAF) rules until a patched version is available.
• Audit existing user-role assignments to identify unauthorized cancellations and restore intended memberships.
• Rotate or reduce privileges for accounts that no longer require access to role-management functions.

Patch Information

The vendor did not respond to disclosure attempts and no official patch is referenced in the advisory. Monitor the yangzongzhuan RuoYi project for updates beyond version 4.8.1 and apply any subsequent security release addressing the Role Handler authorization gap.

Workarounds

• Add a server-side authorization check to the cancelAll controller that validates the caller holds the system:role:edit permission and has authority over the target roleId.
• Apply a WAF rule that blocks requests to /system/role/authUser/cancelAll from sessions lacking an administrative role claim.
• Remove or disable the cancelAll route in deployments that do not require bulk role-cancellation functionality.

# Example nginx rule to block the vulnerable endpoint at the edge
location = /system/role/authUser/cancelAll {
    return 403;
}