CVE-2025-70986: RuoYi Access Control Bypass Vulnerability

CVE-2025-70986 Overview

CVE-2025-70986 is an incorrect access control vulnerability in the selectDept function of RuoYi v4.8.2. This flaw allows unauthorized attackers to arbitrarily access sensitive department data without proper authentication or authorization checks. RuoYi is a popular open-source Java rapid development platform used for building enterprise management systems, making this vulnerability particularly concerning for organizations relying on this framework.

Critical Impact

Unauthorized attackers can exploit this vulnerability to access sensitive organizational department information, potentially exposing confidential business data, employee hierarchies, and internal organizational structures.

Affected Products

• RuoYi v4.8.2
• RuoYi versions prior to v4.8.2 may also be affected

Discovery Timeline

• 2026-01-23 - CVE-2025-70986 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2025-70986

Vulnerability Analysis

This vulnerability stems from improper access control implementation (CWE-284) in the selectDept function within the RuoYi framework. The flaw allows unauthenticated or low-privileged users to bypass authorization mechanisms and directly query department data that should be restricted based on user roles and permissions.

The attack can be executed remotely over the network without requiring any user interaction, making it particularly dangerous in internet-facing deployments. The vulnerability primarily impacts confidentiality, as attackers can extract sensitive organizational information without authorization.

Root Cause

The root cause of CVE-2025-70986 is the failure to implement proper access control checks within the selectDept function. The function does not adequately validate whether the requesting user has sufficient privileges to access department data before returning results. This missing authorization check allows any user—authenticated or not—to query and retrieve department information that should be restricted based on organizational security policies.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can craft HTTP requests directly to the vulnerable endpoint handling the selectDept function. By manipulating request parameters or directly invoking the API endpoint, attackers can enumerate and extract department data including names, hierarchies, and associated metadata.

The exploitation process typically involves:

1. Identifying the vulnerable RuoYi deployment
2. Crafting requests to the department selection API endpoint
3. Iterating through department IDs or using wildcard queries
4. Extracting sensitive organizational structure data

For technical details and proof-of-concept information, refer to the GitHub Gist documentation and the Gitee Issue Discussion.

Detection Methods for CVE-2025-70986

Indicators of Compromise

• Unusual or repeated requests to department-related API endpoints from unauthenticated sources
• Access logs showing enumeration patterns targeting /system/dept/ or similar paths
• Requests to selectDept endpoints without proper session tokens or authentication headers
• Abnormal spikes in department data queries from single IP addresses

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block unauthorized access attempts to department endpoints
• Monitor application logs for repeated requests to department selection functions without valid authentication
• Deploy SentinelOne Singularity Platform to detect anomalous API access patterns and unauthorized data retrieval attempts
• Establish baseline access patterns for department data and alert on deviations

Monitoring Recommendations

• Enable detailed logging for all API endpoints related to organizational data access
• Configure alerts for requests to selectDept or department listing endpoints that lack proper authentication
• Monitor for sequential department ID enumeration patterns in access logs
• Implement rate limiting on sensitive organizational data endpoints

How to Mitigate CVE-2025-70986

Immediate Actions Required

• Upgrade RuoYi to the latest patched version that addresses this access control vulnerability
• Implement authentication requirements on the selectDept function if not already present
• Add role-based access control (RBAC) checks to ensure users can only access departments within their authorized scope
• Review and restrict network access to RuoYi administrative endpoints

Patch Information

Organizations should monitor the official RuoYi repositories for security updates. Consult the Gitee Project Repository or GitHub RuoYi Project for the latest releases and patch information. Apply any available security patches immediately after testing in a non-production environment.

Workarounds

• Implement a reverse proxy or WAF to enforce authentication on vulnerable endpoints before a patch is applied
• Temporarily disable or restrict access to the selectDept functionality until the vulnerability is remediated
• Apply network segmentation to limit exposure of the RuoYi application to trusted networks only
• Implement custom authorization middleware to validate user permissions before processing department queries

# Example: Restrict access to department endpoints via nginx
location /system/dept/ {
    # Require authentication header
    if ($http_authorization = "") {
        return 401;
    }
    
    # Limit access to internal networks
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    
    proxy_pass http://ruoyi-backend;
}