CVE-2025-10988: Ruoyi-vue-pro Auth Bypass Vulnerability

CVE-2025-10988 Overview

CVE-2025-10988 is an improper authorization vulnerability [CWE-266] in YunaiV ruoyi-vue-pro versions up to 2025.09. The flaw resides in an unspecified function of the /crm/business/transfer endpoint, which handles ownership transfer of Customer Relationship Management (CRM) business records. Attackers with low-privileged authenticated access can manipulate the endpoint remotely to bypass authorization controls. The exploit details are publicly available, increasing the likelihood of opportunistic abuse. The vendor was contacted regarding this disclosure but did not respond.

Critical Impact
Authenticated remote attackers can abuse the CRM business transfer function to perform actions outside their authorized scope, affecting the confidentiality, integrity, and availability of CRM records.

Affected Products

YunaiV ruoyi-vue-pro versions up to and including 2025.09
Deployments exposing the /crm/business/transfer endpoint
Iocoder ruoyi-vue-pro distributions tracked under cpe:2.3:a:iocoder:ruoyi-vue-pro

Discovery Timeline

2025-09-26 - CVE-2025-10988 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10988

Vulnerability Analysis

The vulnerability exists in the CRM business transfer handler exposed at /crm/business/transfer. The endpoint accepts requests to reassign ownership of business records but fails to enforce authorization checks consistent with the requester's role and data ownership. As a result, a low-privileged authenticated user can submit transfer requests targeting records they should not be able to modify. The flaw is reachable over the network and requires no user interaction beyond the attacker's own session.

The weakness is classified under [CWE-266] (Incorrect Privilege Assignment). The issue stems from missing or insufficient permission validation at the controller layer rather than from input parsing or memory safety. Exploitation does not require crafted payloads, only knowledge of the endpoint and valid record identifiers.

Root Cause

The /crm/business/transfer handler does not adequately verify that the authenticated principal owns the target business record or holds the role required to reassign it. Authorization decisions appear to rely on the presence of a valid session rather than on per-record ownership checks. This pattern allows horizontal privilege escalation across CRM tenants or users within the same instance.

Attack Vector

An attacker authenticates to the application with a low-privilege account. They then issue an HTTP request to /crm/business/transfer containing identifiers for a business record owned by another user and a target owner of their choosing. The backend processes the transfer because role-scoped ownership validation is missing. No synthetic exploit code is reproduced here. See the VulDB entry #325911 and the CNBlogs analysis for additional technical context.

Detection Methods for CVE-2025-10988

Indicators of Compromise

HTTP POST requests to /crm/business/transfer originating from accounts that do not own the referenced business records.
Unexpected changes in the owner_user_id field of CRM business records without a corresponding administrative action in audit logs.
Bursts of transfer requests from a single low-privileged session targeting multiple distinct record IDs.

Detection Strategies

Correlate application access logs against CRM ownership change events to identify transfers performed by non-owners or non-administrators.
Baseline normal usage of the /crm/business/transfer endpoint per user role and alert on deviations such as high-volume use by standard users.
Inspect database audit trails for crm_business table updates where the actor's role lacks the documented transfer permission.

Monitoring Recommendations

Enable verbose request logging for all /crm/business/* endpoints, capturing the authenticated principal and target record identifiers.
Forward application and database audit logs to a centralized analytics platform for correlation across user sessions and record changes.
Track failed and successful authorization decisions on CRM endpoints to surface enumeration attempts before successful exploitation.

How to Mitigate CVE-2025-10988

Immediate Actions Required

Restrict network exposure of the /crm/business/transfer endpoint to trusted internal users through web application firewall (WAF) rules or reverse proxy ACLs.
Audit recent CRM business ownership changes and revert unauthorized transfers identified through log review.
Reduce account privileges for users who do not require transfer functionality and rotate credentials of any suspicious accounts.

Patch Information

No vendor patch has been published. The vendor did not respond to disclosure attempts according to the public CVE record. Monitor the ruoyi-vue-pro project references on VulDB for updates and apply fixes as soon as the maintainers release them.

Workarounds

Implement a server-side authorization filter that validates the requester owns the target record or holds an administrative role before allowing transfer.
Block or rate-limit the /crm/business/transfer endpoint at the gateway layer for accounts outside designated CRM administrator groups.
Apply role-based access control (RBAC) reviews to remove unnecessary CRM permissions from standard user roles until a vendor fix is available.

bash

# Configuration example: nginx rule restricting the transfer endpoint to an internal admin network
location = /crm/business/transfer {
    allow 10.0.10.0/24;   # CRM administrators subnet
    deny  all;
    proxy_pass http://ruoyi_backend;
}