CVE-2026-119647: RuoYi-Vue-Plus through 6.0.0 Data-Scope Bypass via /system/user/list/dept/{deptId}
RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authenticated users to read users of other departments. Users holding system:user:list under a department-restricted role can request GET /system/user/list/dept/{deptId} with any department id to obtain usernames, nicknames, account status, last login IP and time, and remarks.
Event History
Frequently Asked Questions
Which users and deployments are exposed?
Deployments through 6.0.0 are exposed when a user has the system:user:list permission while assigned a role with department-based data restrictions. The issue affects access to user records outside the caller’s permitted department scope.
Does exploitation require authentication or special interaction?
An attacker must be authenticated and hold system:user:list. No user interaction is required; the attacker can request the department-list endpoint using an arbitrary department ID.
What information could be exposed?
The endpoint can disclose users from other departments, including usernames, nicknames, account status, last-login IP addresses and times, and remarks.
How can we investigate possible exploitation?
Review requests to GET /system/user/list/dept/{deptId}, especially requests where the requested department ID is outside the authenticated caller’s department-restricted scope. Correlate those requests with accounts holding system:user:list.