CVE-2026-57950
High
Description
ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a broken access control vulnerability in ErpSaleOrderController that allows attackers with erp:sale-out permissions to gain unauthorized access to sale order operations by exploiting an incorrect permission namespace enforcement. Attackers holding shipment-level permissions can perform unauthorized create, update, delete, and read operations on financially sensitive sale orders due to the controller enforcing erp:sale-out instead of the intended erp:sale-order namespace.
SeverityHigh
CVSS8.1
Exploit probability—
ProductYunai Ruoyi-vue-pro
PublishedJun 29, 2026
First seenJun 29, 2026
Weakness typeCWE-863Incorrect authorization
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Yunai ruoyi-vue-pro | v ≤ 2026.05 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.