CVE-2025-70985: Critical severity Ruoyi Ruoyi vulnerability
Published Jan 23, 2026
·Updated
Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their scope.
Affected Software
3 affected components
Ruoyi Ruoyi
Ruoyi Ruoyi=4.8.1
Ruoyi Ruoyi=4.8.2
Event History
Jan 23, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·07:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-70985?
CVE-2025-70985 is classified as a critical severity vulnerability due to its potential for unauthorized data modification.
2
How do I fix CVE-2025-70985?
To fix CVE-2025-70985, update to the latest version of RuoYi that addresses this access control issue.
3
What types of attacks are possible due to CVE-2025-70985?
CVE-2025-70985 allows unauthorized attackers to arbitrarily modify data, potentially leading to data corruption or unauthorized access.
4
Which software versions are affected by CVE-2025-70985?
CVE-2025-70985 affects RuoYi version 4.8.2 and possibly earlier versions.
5
Who can exploit CVE-2025-70985?
CVE-2025-70985 can be exploited by any unauthorized user who can access the update function in RuoYi v4.8.2.