CVE-2026-57949 HIGH

CVE-2026-57949: ruoyi-vue-pro - Missing Authorization in CRM Follow-up Record GET Endpoint

Vendor Yunai
Product ruoyi-vue-pro
Weakness CWE-862 · Missing authorization
Published June 29, 2026
Last update June 30, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

ruoyi-vue-pro through 2026.05, fixed in commit c779a47, contains a missing authorization vulnerability in the CRM module's GET /admin-api/crm/follow-up-record/get endpoint that allows authenticated users to read any follow-up record by iterating sequential numeric IDs. Attackers can exploit this by sending requests with arbitrary ID parameters to access other users' follow-up notes, file attachments, scheduling information, and business entity references without proper authorization checks.

Key dates

02Disclosure timeline

June 29, 2026 CVE published
June 30, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2022-4366 Missing Authorization in lirantal/daloradius CVE-2026-1655 EventPrime <= 4.2.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event_id' Parameter CVE-2025-36192 Missing Authorization with the DS8900F and DS8A00 Hardware Management Console CVE-2026-26207 DIscourse's discourse-policy plugin lacks post access check CVE-2026-9284 WooCommerce PayPal Payments <= 4.0.1 - Missing Authorization to Unauthenticated Order Manipulation and Information Disclosure