Which versions of ruoyi-vue-pro are affected by EUVD-2026-40166?

ruoyi-vue-pro CRM module contains a broken object-level authorization vulnerability in the follow-up record endpoint, enabling authenticated users to read other users' confidential follow-up notes,…

How to fix or mitigate EUVD-2026-40166?

Within 24 hours: Audit all ruoyi-vue-pro CRM instances in your environment and restrict network access to /admin-api/crm/follow-up-record endpoints via WAF or firewall rules. Within 7 days: Apply upstream fix from commit c779a47, test in staging environment to validate authorization controls prevent cross-user record access. Within 30 days: Complete production deployment and verify unauthorized cross-user CRM record access is no longer possible.

ruoyi-vue-pro EUVD-2026-40166

Q: What is the CVSS score of EUVD-2026-40166?

EUVD-2026-40166 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-57949 HIGH

Missing Authorization (CWE-862)

2026-06-29 disclosure@vulncheck.com

GHSA-pv3j-frmx-3v9q

Authentication Bypass

7.1

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable API needing only a low-privilege authenticated account (PR:L) with no user interaction; impact is unauthorized data disclosure only, so C:H and I:N/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 18:33 vuln.today

DescriptionCVE.org

ruoyi-vue-pro through 2026.05, fixed in commit c779a47, contains a missing authorization vulnerability in the CRM module's GET /admin-api/crm/follow-up-record/get endpoint that allows authenticated users to read any follow-up record by iterating sequential numeric IDs. Attackers can exploit this by sending requests with arbitrary ID parameters to access other users' follow-up notes, file attachments, scheduling information, and business entity references without proper authorization checks.

AnalysisAI

Broken object-level authorization (IDOR) in the ruoyi-vue-pro CRM module lets any authenticated user read arbitrary follow-up records via the GET /admin-api/crm/follow-up-record/get endpoint, which fails to verify record ownership. Because record IDs are sequential integers, a low-privileged user can enumerate IDs to harvest other users' follow-up notes, file attachments, scheduling data, and linked business-entity references. No public exploit or active exploitation has been reported; the issue is fixed upstream in commit c779a47.

Technical ContextAI

ruoyi-vue-pro (YunaiV/ruoyi-vue-pro) is a popular Spring Boot / Vue rapid-development platform derived from the RuoYi framework, widely used to build admin and business backends including a built-in CRM module. The flaw is a CWE-862 Missing Authorization: the /admin-api/crm/follow-up-record/get handler authenticates the caller (a valid session/token is required) but never performs an object-level ownership or data-scope check tying the requested follow-up-record ID to the caller's permitted records. Combined with predictable sequential numeric primary keys, this becomes a classic Broken Object Level Authorization (BOLA/IDOR) issue where authorization is enforced at the route level but not at the data level.

RemediationAI

Upstream fix available (commit c779a47); a tagged/released patched version is not independently confirmed from the provided data, so operators should update to a build that incorporates commit c779a476617c58a38904191094d22df254b42542 (see https://github.com/YunaiV/ruoyi-vue-pro/commit/c779a476617c58a38904191094d22df254b42542 and issue https://github.com/YunaiV/ruoyi-vue-pro/issues/1159). If you cannot rebuild immediately, add a server-side ownership/data-scope check on the follow-up-record/get endpoint so a record is only returned when it belongs to the caller's permitted scope; this is the correct fix but requires code changes. As an interim compensating control, restrict or revoke CRM-module access for untrusted or low-trust accounts and tighten data-permission roles, accepting that this reduces legitimate CRM usage. Enable access logging and alert on rapid sequential-ID enumeration of /admin-api/crm/follow-up-record/get via WAF or rate limiting, noting this detects rather than prevents the abuse and may produce false positives on legitimate bulk activity.