Which versions of ruoyi-vue-pro are affected by CVE-2026-57950?

Warehouse and shipment staff in ruoyi-vue-pro deployments (version 2026.05 and earlier) can perform unauthorized modifications, deletions, and creation of sales orders outside their operational…

How to fix or mitigate CVE-2026-57950?

Within 24 hours: Identify all ruoyi-vue-pro instances running version 2026.05 or earlier and generate access logs for ErpSaleOrderController activity; cross-reference shipment-level users ('erp:sale-out' permission holders) against order modification events. Within 7 days: Apply upstream fix from repository commit 5d1fd70 if possible, or prepare for immediate deployment of vendor-released patch; validate that ErpSaleOrderController enforces 'erp:sale-order' permission namespace. Within 30 days: Complete forensic audit of all ERP sales order CRUD operations by low-privilege accounts since system deployment; implement and test permanent access control enforcement.

ruoyi-vue-pro CVE-2026-57950

Q: What is the CVSS score of CVE-2026-57950?

CVE-2026-57950 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-40167 HIGH

Incorrect Authorization (CWE-863)

2026-06-29 disclosure@vulncheck.com

GHSA-r39c-vf2w-53j7

Authentication Bypass

8.6

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Authenticated low-privilege user (PR:L) sends network requests (AV:N/AC:L) abusing a misnamed permission check to read and modify sale-order data (C:H/I:H); no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 18:34 vuln.today

DescriptionCVE.org

ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a broken access control vulnerability in ErpSaleOrderController that allows attackers with erp:sale-out permissions to gain unauthorized access to sale order operations by exploiting an incorrect permission namespace enforcement. Attackers holding shipment-level permissions can perform unauthorized create, update, delete, and read operations on financially sensitive sale orders due to the controller enforcing erp:sale-out instead of the intended erp:sale-order namespace.

AnalysisAI

Broken access control in the ErpSaleOrderController of ruoyi-vue-pro (through version 2026.05) lets authenticated users holding only shipment-level 'erp:sale-out' permissions perform full create, read, update, and delete operations on financially sensitive ERP sale orders. The controller enforces the wrong permission namespace ('erp:sale-out' instead of the intended 'erp:sale-order'), so low-privileged warehouse/shipment operators effectively gain order-management authority. No public exploit identified at time of analysis and the issue is not in CISA KEV; an upstream fix exists as commit 5d1fd70.

Technical ContextAI

ruoyi-vue-pro is a widely used Java/Spring Boot + Vue rapid-development platform (YunaiV) that ships an ERP module. Authorization in this stack is enforced declaratively, typically via Sa-Token/Spring annotations such as @PreAuthorize("@ss.hasPermission('...')") on controller methods. The root cause is CWE-863 (Incorrect Authorization): the ErpSaleOrderController endpoints were annotated with the 'erp:sale-out' (sale shipment) permission string rather than the 'erp:sale-order' string they should require. Because the platform's RBAC model treats each colon-delimited string as a distinct privilege, a role granted shipment permissions silently inherits access to a different functional namespace, collapsing the intended separation between shipment handling and order management.

RemediationAI

Upstream fix available (commit 5d1fd70dc3e61bf64e7ce3328a71cc60001175c6); a released patched version was not independently confirmed from the input, so pull the fix from the YunaiV/ruoyi-vue-pro repository or rebuild from a build that includes that commit. As an immediate compensating control until you deploy the corrected build, audit and tighten role assignments so no role granted 'erp:sale-out' is also trusted with order operations - practically, separate shipment-only roles from accounts that should not touch sale orders, accepting that warehouse operators may lose convenience access they were implicitly relying on. Alternatively, manually correct the @PreAuthorize permission strings on ErpSaleOrderController endpoints to require 'erp:sale-order' as a hotfix, but only if you can rebuild and verify it does not break legitimate workflows. Reference the commit diff and the VulnCheck advisory (https://www.vulncheck.com/advisories/ruoyi-vue-pro-incorrect-permission-namespace-in-erpsaleordercontroller) to confirm the exact endpoints changed.