CVE-2025-46174

Ruoyi v4.8.0 vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the resetPwd Method of SysUserController.java.

Score

CVSS 3.1 7.5 High

Status

Modified - cve@mitre.org

Published

2025-11-26

Last modified

2025-12-04

Weaknesses

CWE-284, CWE-862

Affected products

• Ruoyi (Ruoyi)

References

• https://gist.github.com/Han-tj/29543ce0dae8cbb3bcbedca3390844a9
• https://gitee.com/y_project/RuoYi/commit/ea4af7a8cf54393b11d3d286e0aaeb3df8a9aaef
• https://gitee.com/y_project/RuoYi/issues/IC1JZR