CVE-2025-70986: High severity Ruoyi Ruoyi vulnerability
Published Jan 23, 2026
·Updated
Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data.
Affected Software
3 affected components
Ruoyi Ruoyi
Ruoyi Ruoyi=4.8.1
Ruoyi Ruoyi=4.8.2
Event History
Jan 23, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·07:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-70986?
CVE-2025-70986 has been classified as a critical severity vulnerability due to incorrect access control.
2
How do I fix CVE-2025-70986?
To fix CVE-2025-70986, ensure that proper access controls are implemented and validate permissions in the selectDept function.
3
What type of vulnerability is CVE-2025-70986?
CVE-2025-70986 is an access control vulnerability that allows unauthorized access to sensitive department data.
4
Which version of RuoYi is affected by CVE-2025-70986?
RuoYi v4.8.2 is the affected version with the vulnerability CVE-2025-70986.
5
What could be the impact of exploiting CVE-2025-70986?
Exploiting CVE-2025-70986 could allow unauthorized attackers to gain access to sensitive department information, leading to potential data breaches.