CVE-2026-108825: Improper Privilege Management in yangzongzhuan RuoYi

This vulnerability affects yangzongzhuan RuoYi up to version 4.8.3 in the checkRoleAllowed function of the /system/role/authDataScope component. Improper handling of the roleKey argument allows attackers to bypass privilege restrictions remotely. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no user interaction, and limited privileges required. Public exploit disclosure exists, but no confirmed in-the-wild exploitation has been observed. The vendor has not issued any fix or advisory.

Successful exploitation can lead to improper privilege management, potentially allowing attackers to gain unauthorized access or escalate privileges within the affected system. This could compromise system integrity or confidentiality depending on the roles affected. However, the impact is limited by the requirement for low privileges and the absence of user interaction.

No official patch or remediation is currently available from the vendor. Users should monitor vendor channels for updates. Until a fix is released, consider restricting network access to the affected service and reviewing roleKey usage to mitigate risk. Avoid deploying affected versions in sensitive environments if possible.