CVE-2026-57949 is a missing authorization vulnerability in ruoyi-vue-pro through version 2026.05. The flaw resides in the CRM module's GET /admin-api/crm/follow-up-record/get endpoint, which lacks proper authorization validation. Authenticated users can enumerate sequential numeric IDs to retrieve follow-up records of other users, exposing sensitive data such as notes, attachments, scheduling information, and business entity references. The issue was fixed in commit c779a47, but no official patch advisory or remediation level is currently documented. The CVSS 4.0 score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required beyond authentication, and high confidentiality impact.

An authenticated attacker can access follow-up records belonging to other users without authorization, leading to unauthorized disclosure of sensitive CRM data including notes, file attachments, scheduling information, and business entity references. This compromises confidentiality of business and user information within the CRM module.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is reportedly fixed in commit c779a47, so applying the corresponding update or patch from the vendor is recommended once available. Until then, restrict access to the affected endpoint to trusted users only and monitor for suspicious activity involving sequential ID enumeration.