CVE-2026-57950: ruoyi-vue-pro Auth Bypass Vulnerability

CVE-2026-57950 Overview

CVE-2026-57950 is a broken access control vulnerability [CWE-863] affecting the ruoyi-vue-pro ERP application through version 2026.05. The flaw resides in ErpSaleOrderController, where sale order endpoints enforce the erp:sale-out permission namespace instead of the intended erp:sale-order namespace. Attackers holding shipment-level permissions can create, update, delete, and read financially sensitive sale orders without proper authorization. The issue is fixed in commit 5d1fd70.

Critical Impact
Authenticated users with erp:sale-out shipment permissions can perform unauthorized create, read, update, and delete operations against sale orders, exposing financially sensitive data and enabling business logic abuse.

Affected Products

ruoyi-vue-pro through version 2026.05
yudao-module-erp component (ErpSaleOrderController)
Deployments prior to commit 5d1fd70dc3e61bf64e7ce3328a71cc60001175c6

Discovery Timeline

2026-06-29 - CVE-2026-57950 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-57950

Vulnerability Analysis

The vulnerability stems from incorrect permission namespace enforcement in the ErpSaleOrderController class within the yudao-module-erp module. Endpoints that manage sale orders declare @PreAuthorize annotations tied to erp:sale-out:* (sale shipment) permissions rather than erp:sale-order:* (sale order) permissions. This design flaw is classified as [CWE-863] Incorrect Authorization.

Because sale shipment and sale order are distinct business domains, users granted shipment-level roles inherit unintended access to sales order operations. The impact includes unauthorized creation of orders, modification of order status, deletion of records, and disclosure of financially sensitive data.

Root Cause

Developers copied or reused the erp:sale-out permission string across sale order endpoints. The role-based access control (RBAC) check succeeds for any principal holding shipment permissions, bypassing the intended segregation between order management and outbound shipping duties.

Attack Vector

Exploitation requires network access to the ERP web interface and a low-privileged authenticated account holding any erp:sale-out permission. The attacker sends standard HTTP requests to the sale order endpoints (for example /create, /update, /update-status). The server evaluates the incorrect permission namespace and authorizes the operation.

java

     @PostMapping("/create")
     @Operation(summary = "创建销售订单")
-    @PreAuthorize("@ss.hasPermission('erp:sale-out:create')")
+    @PreAuthorize("@ss.hasPermission('erp:sale-order:create')")
     public CommonResult<Long> createSaleOrder(@Valid @RequestBody ErpSaleOrderSaveReqVO createReqVO) {
         return success(saleOrderService.createSaleOrder(createReqVO));
     }

     @PutMapping("/update")
     @Operation(summary = "更新销售订单")
-    @PreAuthorize("@ss.hasPermission('erp:sale-out:update')")
+    @PreAuthorize("@ss.hasPermission('erp:sale-order:update')")
     public CommonResult<Boolean> updateSaleOrder(@Valid @RequestBody ErpSaleOrderSaveReqVO updateReqVO) {
         saleOrderService.updateSaleOrder(updateReqVO);
         return success(true);
     }

     @PutMapping("/update-status")
     @Operation(summary = "更新销售订单的状态")
-    @PreAuthorize("@ss.hasPermission('erp:sale-out:update-status')")
+    @PreAuthorize("@ss.hasPermission('erp:sale-order:update-status')")
     public CommonResult<Boolean> updateSaleOrderStatus(@RequestParam("id") Long id,
                                                       @RequestParam("status") Integer status) {
         saleOrderService.updateSaleOrderStatus(id, status);

Source: GitHub commit 5d1fd70. The patch replaces erp:sale-out:* with erp:sale-order:* across the sale order endpoints, restoring correct authorization boundaries.

Detection Methods for CVE-2026-57950

Indicators of Compromise

Access log entries showing accounts with only erp:sale-out role assignments issuing requests to /admin-api/erp/sale-order/* endpoints.
Unexpected POST /create, PUT /update, PUT /update-status, and DELETE /delete operations on sale order resources originating from shipment operators.
Audit trail anomalies where sale order records are modified outside of expected sales staff sessions.

Detection Strategies

Correlate authenticated user roles with the endpoint paths invoked in HTTP access logs to identify permission-namespace mismatches.
Query application audit tables for sale order create, update, or delete actions performed by user IDs whose role mapping only contains erp:sale-out grants.
Compare deployed source of ErpSaleOrderController.java against the fixed commit 5d1fd70 to confirm whether the vulnerable annotations are present.

Monitoring Recommendations

Enable request-level logging on all /admin-api/erp/sale-order/* routes and forward events to a centralized log platform for analysis.
Alert on write operations against sale orders performed by principals lacking the erp:sale-order role.
Track deletion and status-change events on financially sensitive tables to catch tampering early.

How to Mitigate CVE-2026-57950

Immediate Actions Required

Upgrade ruoyi-vue-pro to a build that includes commit 5d1fd70dc3e61bf64e7ce3328a71cc60001175c6 or later.
Audit all user and role assignments granting erp:sale-out:* and revoke any that were provisioned only for shipment duties.
Review sale order records for unauthorized modifications since the vulnerable version was deployed.

Patch Information

The upstream fix is available in the GitHub commit 5d1fd70. The commit updates @PreAuthorize annotations in ErpSaleOrderController from erp:sale-out:* to erp:sale-order:*. Additional context is available in the GitHub Issue 1161 and the VulnCheck Security Advisory.

Workarounds

Temporarily remove the erp:sale-out role from any account that should not access sale orders until the patch can be applied.
Manually edit ErpSaleOrderController.java to replace erp:sale-out:* permission strings with erp:sale-order:* and rebuild the application.
Restrict network access to the ERP administrative API using an ingress allowlist while remediation is pending.

bash

# Verify the deployed controller uses the correct permission namespace
grep -n "erp:sale-out" yudao-module-erp/src/main/java/cn/iocoder/yudao/module/erp/controller/admin/sale/ErpSaleOrderController.java
# Expected result after patching: no matches (all references should be erp:sale-order)

# Pull and apply the upstream fix
git fetch origin
git checkout 5d1fd70dc3e61bf64e7ce3328a71cc60001175c6 -- \
  yudao-module-erp/src/main/java/cn/iocoder/yudao/module/erp/controller/admin/sale/ErpSaleOrderController.java
mvn clean package -DskipTests