CVE-2026-57950: ruoyi-vue-pro Permission Bypass Affecting ERP Sale Orders

Technical summary

The ErpSaleOrderController in ruoyi-vue-pro through version 2026.05 implements permission checks using the 'erp:sale-out' namespace when it should enforce 'erp:sale-order' permissions. This broken access control (CWE-863) allows authenticated users holding lower-privileged 'erp:sale-out' roles to perform CRUD operations on sale orders by exploiting the permission namespace mismatch. The vulnerability was remediated in commit 5d1fd70, which corrects the permission enforcement logic. The attack requires only network access and valid authentication—no elevated privileges or user interaction is needed, making exploitation straightforward for any authenticated user on the system.

Business impact

This vulnerability can lead to unauthorized modification or deletion of financial sale order records, enabling data tampering, fraudulent transactions, or inventory manipulation. Organizations using affected versions face risks of financial statement inaccuracy, audit trail compromise, and potential regulatory non-compliance. The ability to both read and modify sensitive orders creates liability exposure and may result in undetected fraud. Supply chain and order fulfillment processes could be disrupted through unauthorized deletions or modifications. The CVSS 8.1 severity reflects the high-integrity and confidentiality impact to business-critical financial data.

Affected systems

ruoyi-vue-pro versions through 2026.05 are affected. The vulnerability is present in the ErpSaleOrderController module, which is part of the core ERP functionality. Any deployment of affected versions with multi-user environments and role-based access control enabled is at risk. Systems where users are provisioned with 'erp:sale-out' permissions are directly vulnerable. The software is widely used in Asia-Pacific organizations and appears in numerous open-source deployments; verify your ruoyi-vue-pro version and whether ErpSaleOrderController is in use.

Exploitability

This vulnerability has low exploitation barriers. It requires only network connectivity and valid system credentials (any user with 'erp:sale-out' role). No special tools, code execution, or user interaction are needed. A simple authenticated HTTP request to the ErpSaleOrderController endpoints can trigger unauthorized operations. The attack is deterministic and leaves standard audit trails unless logging is specifically disabled. Because the flaw is in permission enforcement logic rather than requiring a complex attack chain, it is highly likely to be discovered through routine testing or accidental exploitation during normal system usage.

Remediation

Update ruoyi-vue-pro to a version that includes the fix from commit 5d1fd70 or later. This patch corrects the permission namespace enforcement in ErpSaleOrderController. After patching, validate that 'erp:sale-order' permissions are now correctly enforced and that users with 'erp:sale-out' access can no longer perform unauthorized sale order operations. Organizations should also review role assignments to ensure least-privilege principles are applied, restricting financial order access only to intended users. Test the patch in a staging environment to verify functional impact before production deployment.

Patch guidance

Apply the security patch from commit 5d1fd70 or later when updating ruoyi-vue-pro. Verify against the vendor's official release notes and commit history on their repository to confirm patch inclusion. Test the update in a non-production environment first to ensure compatibility with custom extensions or local modifications to ErpSaleOrderController. After deployment, audit existing role assignments to remove any unintended 'erp:sale-out' permissions that may have been leveraged during the vulnerable period. Confirm through functional testing that sale order operations now require the correct 'erp:sale-order' namespace permission.

Detection guidance

Monitor ErpSaleOrderController access logs for requests originating from users with 'erp:sale-out' permissions performing create, update, or delete operations on sale orders. Baseline typical sale order operations by role and alert on anomalies. Review database audit logs for unauthorized modifications to sale order records, particularly deletions or bulk updates. Check application logs for permission denial errors that may indicate exploitation attempts. Implement network-level detection rules for authenticated requests to ErpSaleOrderController endpoints followed by data modification events. Forensic investigation should focus on the period before patch deployment to identify whether the vulnerability was exploited.

Why prioritize this

This vulnerability merits urgent patching because it directly compromises financial data integrity through a straightforward, authenticated attack requiring no elevated privileges. The CVSS 8.1 score and the combination of high-impact (integrity and confidentiality of sensitive orders) with low-friction exploitation make this a material business and compliance risk. Sale order systems are typically subject to audit and regulatory requirements; unauthorized modifications could trigger audit failures and regulatory exposure. The fix is available and straightforward to apply, reducing patch complexity relative to the risk.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects: network-accessible attack vector (AV:N), low attack complexity (AC:L), requirement for low privileges (PR:L), no user interaction needed (UI:N), unchanged scope (S:U), high confidentiality impact (C:H) through read access to sensitive orders, and high integrity impact (I:H) through unauthorized modification or deletion. The score appropriately emphasizes the integrity and confidentiality damage to financial data while accounting for the requirement of valid authentication credentials.

Frequently asked questions