CVE-2026-57949: RuoYi-Vue-Pro CRM Missing Authorization

Technical summary

The CRM module's follow-up record retrieval endpoint lacks proper authorization logic (CWE-862: Missing Authorization). When an authenticated request arrives with a numeric ID parameter, the application returns the associated record without verifying ownership or role-based access rights. The sequential nature of record identifiers makes enumeration straightforward—an attacker authenticated as any user can increment IDs to discover and access records created by colleagues, managers, or competitors' contacts. The vulnerability was addressed in commit c779a47, which presumably added authorization checks to verify the requester's relationship to the record before disclosure.

Business impact

CRM follow-up records often contain confidential sales strategy, client contact information, deal status, negotiation notes, and communication history. Unauthorized access allows competitors or malicious insiders to extract client lists, pipeline intelligence, and negotiation details. Customers may suffer reputational damage if their interaction records are exposed. For organizations using RuoYi-Vue-Pro as a business application, this breach of data confidentiality could expose proprietary sales processes, client relationships, and strategic partnerships. The vulnerability requires authentication, limiting exposure to internal users or those with valid credentials, but the low barrier to exploitation (simple ID manipulation) means any employee can quickly harvest data at scale.

Affected systems

RuoYi-Vue-Pro open-source framework through version 2026.05 is affected. The CRM module's follow-up record endpoint is the confirmed attack surface. Organizations running versions prior to the fixed commit c779a47 are vulnerable. The vulnerability does not require special configuration; it is inherent to the affected versions unless patches or workarounds are already applied. Verify your specific deployment version against the official RuoYi-Vue-Pro repository.

Exploitability

Exploitation is straightforward for any authenticated user. No special privilege level is required—a low-privilege employee account is sufficient. An attacker needs only network access to the API endpoint and valid login credentials. Attacks can be automated by scripting requests with incrementing ID values. The lack of rate limiting or alerting in typical deployments allows bulk record enumeration without detection. The CVSS score of 6.5 reflects high confidentiality impact constrained by the authentication requirement; the attack vector is network-accessible, and there is no user interaction needed once authenticated.

Remediation

Upgrade RuoYi-Vue-Pro to a version incorporating commit c779a47 or later. Apply the patched code which adds authorization checks to the follow-up record endpoint to ensure users can only retrieve records they own or have explicit permission to access. Review and audit the CRM module for similar authorization gaps in other endpoints (e.g., leads, opportunities, contacts). Implement role-based access control (RBAC) at the API layer to enforce data ownership rules consistently. Test remediation by attempting to access another user's records with different credential sets and confirming denial.

Patch guidance

Check the official RuoYi-Vue-Pro repository for releases or commits published after 2026-06-29 that address this vulnerability. Commit c779a47 is documented as the fix; verify this commit is included in your target version. Follow the project's standard update procedure, typically involving code pull, dependency updates, and database migration if applicable. Before deploying to production, verify in a staging environment that authorization checks now prevent cross-user record access. Coordinate the patch deployment to minimize business disruption, as it addresses a confidentiality issue that may already be exploited internally.

Detection guidance

Monitor API logs for repeated requests to /admin-api/crm/follow-up-record/get with varying ID parameters by the same user or session in a short timeframe—a pattern indicative of record enumeration. Implement access logging that records which records were returned to which users and review for anomalies (e.g., a user accessing records they did not create). Set up alerts on 200 responses with high request frequency to the endpoint. Conduct a retrospective audit of follow-up record access logs if available, correlating returned record IDs with user ownership to identify unauthorized disclosures. Consider implementing a Web Application Firewall rule to rate-limit sequential ID requests to the endpoint.

Why prioritize this

Although the CVSS score is 6.5 (MEDIUM), this vulnerability warrants prompt prioritization because it enables unauthorized access to business-critical CRM data without any technical exploitation barrier. The confidentiality impact is high—sales records, client contact information, and deal intelligence are core business assets. The ease of exploitation (simple ID enumeration) means the risk of internal or external abuse is substantial once the vulnerability is known. The vulnerability is not currently in CISA's KEV catalog, but its prevalence in open-source deployments and low exploitation complexity make it attractive to insiders or competitors. Organizations with RuoYi-Vue-Pro CRM deployments should patch within 2–4 weeks.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) correctly reflects a network-accessible, low-complexity attack requiring valid authentication, with high confidentiality impact and no integrity or availability impact. The score appropriately downgrades severity due to the authentication prerequisite but acknowledges the ease of exploitation and sensitive data exposure. In context, the business risk may be elevated if the CRM contains customer PII or high-value deal information; organizations should consider their own risk tolerance and data sensitivity when determining remediation urgency.

Frequently asked questions