Threats tagged 'ghsa-2w47-9873-w85f'

A security vulnerability (CVE-2025-10276) exists in YunaiV ruoyi-vue-pro up to version 2025.09. The flaw is located in the /crm/contract/transfer component and involves improper authorization due to manipulation of the id and newOwnerUserId parameters. Remote exploitation is possible. The vulnerability has a medium severity rating with a CVSS score of 6.3. The vendor has not responded to disclosure attempts, and no patch or remediation guidance is currently available.