CVE-2025-10276: YunaiV ruoyi-vue-pro transfer improper authorization
A security vulnerability has been detected in YunaiV ruoyi-vue-pro up to 2025.09. This vulnerability affects unknown code of the file /crm/contract/transfer. The manipulation of the argument id/newOwnerUserId leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10276?
CVE-2025-10276 has a high severity due to its potential for remote exploitation and improper authorization.
How do I fix CVE-2025-10276?
To fix CVE-2025-10276, update YunaiV ruoyi-vue-pro to a version beyond 2025.09 that addresses the vulnerability.
What types of attacks can be executed due to CVE-2025-10276?
CVE-2025-10276 allows for improper authorization attacks, potentially enabling malicious users to manipulate contracts.
Which versions of YunaiV ruoyi-vue-pro are affected by CVE-2025-10276?
YunaiV ruoyi-vue-pro versions up to and including 2025.09 are affected by CVE-2025-10276.
Is remote exploitation possible with CVE-2025-10276?
Yes, CVE-2025-10276 can be remotely exploited due to improper authorization on the specified endpoint.