The vulnerability CVE-2026-97324 affects the ruoyi-vue-pro software up to version 2026.08. It is located in the updateDemoOrderPaid function within the PayDemoOrderController.java file of the Demo-order Payment Callback Handler component. The issue arises from improper authorization checks on the ID parameter, enabling remote attackers to perform unauthorized actions. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level. The vendor was contacted but has not provided any response or patch. Public exploit code is available.

An attacker can remotely exploit this vulnerability to bypass authorization controls by manipulating the ID argument in the affected function. This could lead to unauthorized payment order updates or related actions within the application. The CVSS score of 6.9 reflects a medium impact with network attack vector and no privileges or user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, restrict access to the affected functionality where possible and consider additional access controls or compensating controls to mitigate unauthorized use.