Threats tagged 'ghsa-67wx-v635-xxc9'

RuoYi-Vue-Plus versions through 6.0.0 have an authorization bypass vulnerability in the SysUserServiceImpl.selectUserListByDept function. This flaw allows authenticated users with the system:user:list permission under a department-restricted role to access user information from any department by specifying arbitrary department IDs. The exposed data includes usernames, nicknames, account status, last login IP and time, and remarks. The vulnerability has a CVSS score of 4.3, indicating medium severity.