CVE-2026-97324: YunaiV/zhijiantianya ruoyi-vue-pro Demo-order Payment Callback PayDemoOrderController.java updateDemoOrderPaid improper authorization
A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/demo/PayDemoOrderController.java of the component Demo-order Payment Callback Handler. The manipulation of the argument ID leads to improper authorization. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be initiated remotely and requires no privileges or user interaction. An attacker manipulates the ID argument passed to the demo-order payment callback handler.
Which deployments are affected?
The affected component is the Demo-order Payment Callback Handler, specifically updateDemoOrderPaid in PayDemoOrderController.java. YunaiV/zhijiantianya ruoyi-vue-pro versions up to 2026.08 are identified as affected.
Is exploitation likely to be practical?
A public exploit is available, and the issue has low attack complexity. The reported impact includes limited compromise of confidentiality, integrity, and availability.
Is a vendor fix available?
The provided information does not identify a fix or patched version. It states that the vendor was contacted before disclosure but did not respond.