CVE-2026-122016yangzongzhuan RuoYi-Vue Permission Service SysPermissionService.java SysPermissionService.getMenuPermission privileges management

A vulnerability was determined in yangzongzhuan RuoYi-Vue up to 3.9.2. This issue affects the function SysPermissionService.getMenuPermission of the file SysPermissionService.java of the component Permission Service. This manipulation of the argument perms causes improper privilege management. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

5.3 MEDIUMEPSS 0.27%Not in KEVNVD: Deferred

Last updated: 2026-11-04 22:17 UTC

OverviewCVSS details

5.3MEDIUMCVSS 4.0

Score source: VulDB (CNA)
NVD status: Deferred
Published: Nov 4, 2026
Assigner: VulDB

Affected

RuoYi-Vue (yangzongzhuan)

Versions: 3.9.0 · 3.9.1

All affected versions →

Exploitation

Public exploit: None listed
CISA KEV: Not listed
KEV due date: —

EPSS · FIRST, scored Nov 7

0.27%chance of exploitation in 30 days

Higher than 19.30% of CVEs

CVSS 4.0 · VulDB (CNA)

5.3Medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: Low
User interaction: None
Confidentiality impact: Low
Integrity impact: Low
Availability impact: Low
Confidentiality (other systems): None
Integrity (other systems): None
Availability (other systems): None

CVSS 3.1 · VulDB (CNA)

6.3Medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality impact: Low
Integrity impact: Low
Availability impact: Low

CVSS 3.1 · VulDB (CNA)

6.3Medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/RC:C

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality impact: Low
Integrity impact: Low
Availability impact: Low

CVSS 3.0 · VulDB (CNA)

6.3Medium

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/RC:C

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality impact: Low
Integrity impact: Low
Availability impact: Low

CVSS 2.0 · VulDB (CNA)

6.5Medium

AV:N/AC:L/Au:S/C:P/I:P/A:P

Attack vector: Network
Attack complexity: Low
Authentication: Single
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

CVSS 2.0 · VulDB (CNA)

6.5Medium

AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:C

Attack vector: Network
Attack complexity: Low
Authentication: Single
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

NVD status: Deferred

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
5.3	MEDIUM	4.0VulDB (CNA)	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
6.3	MEDIUM	3.1VulDB (CNA)	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
6.3	MEDIUM	3.1VulDB (CNA)	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/RC:C
6.3	MEDIUM	3.0VulDB (CNA)	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/RC:C
6.5	MEDIUM	2.0VulDB (CNA)	AV:N/AC:L/Au:S/C:P/I:P/A:P
6.5	MEDIUM	2.0VulDB (CNA)	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:C

Details

CVE ID: CVE-2026-122016
Status: Deferred
Assigner (CNA): VulDB
Published: Nov 4, 2026
Last modified: 2026-11-04 22:17 UTC
Weaknesses: CWE-269 · Improper Privilege Management
CWE-266 · Incorrect Privilege Assignment

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 09:38 UTC.