Threats tagged 'ghsa-2mjj-x5cq-gf63'

A vulnerability exists in YunaiV ruoyi-vue-pro up to version 2025.09 involving improper authorization in a function related to /crm/contact/transfer. The flaw is due to manipulation of the arguments ids and newOwnerUserId, allowing unauthorized actions remotely. Exploit code has been published, but the vendor has not responded or provided a fix. The CVSS score is 6.3, indicating a medium severity impact.