CVE-2025-70986: RuoYi Access Control Bypass Vulnerability

CVE-2025-70986 Overview

CVE-2025-70986 is an incorrect access control vulnerability in the selectDept function of RuoYi v4.8.2. This flaw allows unauthorized attackers to arbitrarily access sensitive department data without proper authentication or authorization checks. RuoYi is a popular open-source Java rapid development platform used for building enterprise management systems, making this vulnerability particularly concerning for organizations relying on this framework.

Critical Impact
Unauthorized attackers can exploit this vulnerability to access sensitive organizational department information, potentially exposing confidential business data, employee hierarchies, and internal organizational structures.

Affected Products

RuoYi v4.8.2
RuoYi versions prior to v4.8.2 may also be affected

Discovery Timeline

2026-01-23 - CVE-2025-70986 published to NVD
2026-01-26 - Last updated in NVD database

Technical Details for CVE-2025-70986

Vulnerability Analysis

This vulnerability stems from improper access control implementation (CWE-284) in the selectDept function within the RuoYi framework. The flaw allows unauthenticated or low-privileged users to bypass authorization mechanisms and directly query department data that should be restricted based on user roles and permissions.

The attack can be executed remotely over the network without requiring any user interaction, making it particularly dangerous in internet-facing deployments. The vulnerability primarily impacts confidentiality, as attackers can extract sensitive organizational information without authorization.

Root Cause

The root cause of CVE-2025-70986 is the failure to implement proper access control checks within the selectDept function. The function does not adequately validate whether the requesting user has sufficient privileges to access department data before returning results. This missing authorization check allows any user—authenticated or not—to query and retrieve department information that should be restricted based on organizational security policies.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can craft HTTP requests directly to the vulnerable endpoint handling the selectDept function. By manipulating request parameters or directly invoking the API endpoint, attackers can enumerate and extract department data including names, hierarchies, and associated metadata.

The exploitation process typically involves:

Identifying the vulnerable RuoYi deployment
Crafting requests to the department selection API endpoint
Iterating through department IDs or using wildcard queries
Extracting sensitive organizational structure data

For technical details and proof-of-concept information, refer to the GitHub Gist documentation and the Gitee Issue Discussion.

Detection Methods for CVE-2025-70986

Indicators of Compromise

Unusual or repeated requests to department-related API endpoints from unauthenticated sources
Access logs showing enumeration patterns targeting /system/dept/ or similar paths
Requests to selectDept endpoints without proper session tokens or authentication headers
Abnormal spikes in department data queries from single IP addresses

Detection Strategies

Implement web application firewall (WAF) rules to detect and block unauthorized access attempts to department endpoints
Monitor application logs for repeated requests to department selection functions without valid authentication
Deploy SentinelOne Singularity Platform to detect anomalous API access patterns and unauthorized data retrieval attempts
Establish baseline access patterns for department data and alert on deviations

Monitoring Recommendations

Enable detailed logging for all API endpoints related to organizational data access
Configure alerts for requests to selectDept or department listing endpoints that lack proper authentication
Monitor for sequential department ID enumeration patterns in access logs
Implement rate limiting on sensitive organizational data endpoints

How to Mitigate CVE-2025-70986

Immediate Actions Required

Upgrade RuoYi to the latest patched version that addresses this access control vulnerability
Implement authentication requirements on the selectDept function if not already present
Add role-based access control (RBAC) checks to ensure users can only access departments within their authorized scope
Review and restrict network access to RuoYi administrative endpoints

Patch Information

Organizations should monitor the official RuoYi repositories for security updates. Consult the Gitee Project Repository or GitHub RuoYi Project for the latest releases and patch information. Apply any available security patches immediately after testing in a non-production environment.

Workarounds

Implement a reverse proxy or WAF to enforce authentication on vulnerable endpoints before a patch is applied
Temporarily disable or restrict access to the selectDept functionality until the vulnerability is remediated
Apply network segmentation to limit exposure of the RuoYi application to trusted networks only
Implement custom authorization middleware to validate user permissions before processing department queries

bash

# Example: Restrict access to department endpoints via nginx
location /system/dept/ {
    # Require authentication header
    if ($http_authorization = "") {
        return 401;
    }
    
    # Limit access to internal networks
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    
    proxy_pass http://ruoyi-backend;
}