CVE-2025-10276

MEDIUM

ruoyi-vue-pro < 2025.09 - Improper Authorization via /crm/contract/transfer id/newOwnerUserId

Title source: llm

Description

A security vulnerability has been detected in YunaiV ruoyi-vue-pro up to 2025.09. This vulnerability affects unknown code of the file /crm/contract/transfer. The manipulation of the argument id/newOwnerUserId leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4

Core References

Third Party Advisory, VDB Entry vdb-entry technical-description

https://vuldb.com/?id.323646

Permissions Required, VDB Entry signature permissions-required

https://vuldb.com/?ctiid.323646

Third Party Advisory, VDB Entry third-party-advisory

https://vuldb.com/?submit.643386

Broken Link broken-link exploit

https://www.cnblogs.com/aibot/p/19063567

Scores

CVSS v3 6.3

EPSS 0.0030

EPSS Percentile 21.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-266 CWE-285

Status published

Products (1)

iocoder/ruoyi-vue-pro < 2025.09

Published Sep 12, 2025

Tracked Since Feb 18, 2026