CVE-2026-57949: ruoyi-vue-pro Auth Bypass Vulnerability

CVE-2026-57949 Overview

CVE-2026-57949 is a missing authorization vulnerability [CWE-862] in the ruoyi-vue-pro application through version 2026.05. The flaw resides in the Customer Relationship Management (CRM) module, specifically in the GET /admin-api/crm/follow-up-record/get endpoint. The endpoint fails to verify that the requesting user has permission to read the requested follow-up record. Authenticated users can iterate sequential numeric IDs to retrieve any follow-up record in the system. Exposed data includes follow-up notes, file attachments, scheduling information, and references to related business entities. The maintainer addressed the issue in commit c779a47.

Critical Impact
Any authenticated low-privileged user can enumerate and read every CRM follow-up record in the system, exposing confidential customer interactions and internal business context.

Affected Products

ruoyi-vue-pro versions through 2026.05
yudao-module-crm component (CrmFollowUpRecordController)
Fixed in commit c779a476617c58a38904191094d22df254b42542

Discovery Timeline

2026-06-29 - CVE-2026-57949 published to the National Vulnerability Database (NVD)
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-57949

Vulnerability Analysis

The vulnerability affects the CRM follow-up record retrieval endpoint in ruoyi-vue-pro, a widely used Java-based enterprise management framework. The controller method backing GET /admin-api/crm/follow-up-record/get accepts a numeric id parameter and returns the corresponding record from the database. The handler authenticates the caller but does not evaluate whether the caller owns or has been granted access to the record. Records use sequential integer identifiers, so an attacker can programmatically enumerate id=1, 2, 3... to harvest every follow-up entry in the tenant. Retrieved records include free-text notes, uploaded file attachments, calendar entries, and foreign keys pointing to related contacts, customers, and business opportunities. The exposure violates confidentiality across sales, support, and account-management workflows.

Root Cause

The root cause is a missing CRM permission check in CrmFollowUpRecordController. The upstream fix imports CrmBizTypeEnum, CrmPermissionLevelEnum, and CrmPermissionService, then invokes the permission service to validate that the authenticated user holds the required permission level on the business entity referenced by the follow-up record. Without this check, authorization is granted solely by session validity.

Attack Vector

An attacker requires only a valid low-privileged account. Using that session, the attacker issues HTTP GET requests to /admin-api/crm/follow-up-record/get?id=N while incrementing N. Each response returns record content owned by other users. The attack can be scripted with a simple loop and executes over the network without user interaction.

java

 import cn.iocoder.yudao.module.crm.dal.dataobject.business.CrmBusinessDO;
 import cn.iocoder.yudao.module.crm.dal.dataobject.contact.CrmContactDO;
 import cn.iocoder.yudao.module.crm.dal.dataobject.followup.CrmFollowUpRecordDO;
+import cn.iocoder.yudao.module.crm.enums.common.CrmBizTypeEnum;
+import cn.iocoder.yudao.module.crm.enums.permission.CrmPermissionLevelEnum;
 import cn.iocoder.yudao.module.crm.service.business.CrmBusinessService;
 import cn.iocoder.yudao.module.crm.service.contact.CrmContactService;
 import cn.iocoder.yudao.module.crm.service.followup.CrmFollowUpRecordService;
+import cn.iocoder.yudao.module.crm.service.permission.CrmPermissionService;
 import cn.iocoder.yudao.module.system.api.user.AdminUserApi;
 import cn.iocoder.yudao.module.system.api.user.dto.AdminUserRespDTO;
 import io.swagger.v3.oas.annotations.Operation;

Source: GitHub commit c779a47 - fix(crm): 修复跟进记录详情越权读取

The patch introduces CrmPermissionService and the associated permission enums so the controller can enforce record-level authorization before returning data.

Detection Methods for CVE-2026-57949

Indicators of Compromise

Repeated authenticated GET requests to /admin-api/crm/follow-up-record/get with rapidly incrementing id parameters from a single session.
HTTP 200 responses returning follow-up records where the ownerUserId does not match the requesting user.
Bulk downloads of CRM attachment URLs shortly after enumeration requests.

Detection Strategies

Deploy application-layer logging on the admin-api/crm routes and alert when a single user retrieves more distinct record IDs than a defined baseline.
Correlate access logs with CRM ownership tables to flag reads of records not owned by, or shared with, the requesting user.
Instrument the CrmFollowUpRecordController.getFollowUpRecord method to emit audit events including caller ID, target record ID, and record owner.

Monitoring Recommendations

Forward web server and application logs to a centralized analytics platform and build dashboards for enumeration patterns against sequential-ID endpoints.
Establish per-user rate limits for CRM read APIs and alert on burst behavior.
Track file-attachment download volume by user to detect exfiltration following unauthorized record access.

How to Mitigate CVE-2026-57949

Immediate Actions Required

Update ruoyi-vue-pro to a build that includes commit c779a476617c58a38904191094d22df254b42542 or later.
Audit CrmFollowUpRecord access logs since deployment to identify unauthorized reads.
Rotate any credentials or sensitive data known to have been referenced inside follow-up notes.
Restrict CRM module access to users with a legitimate business need until the patch is applied.

Patch Information

The fix is available in the upstream repository at GitHub commit c779a47. The patch wires CrmPermissionService into CrmFollowUpRecordController and enforces CrmPermissionLevelEnum checks against the CrmBizTypeEnum of the requested record. See the VulnCheck advisory and the related GitHub issue #1159 for context.

Workarounds

Place the /admin-api/crm/follow-up-record/get endpoint behind a reverse proxy that enforces per-user rate limiting until patching is complete.
Add a temporary server-side filter that verifies the record ownerUserId matches the caller before returning the response.
Disable the CRM follow-up feature for non-privileged roles by modifying role-permission mappings if patch deployment is delayed.

bash

# Verify the installed build contains the security patch
cd ruoyi-vue-pro
git log --oneline | grep c779a47

# Pull and rebuild against the fixed commit
git fetch origin
git checkout c779a476617c58a38904191094d22df254b42542
mvn clean package -DskipTests