CVE-2025-56396

HIGH

Ruoyi 4.8.1 - Privilege Escalation via Department Ownership

Title source: llm
STIX 2.1

Description

An issue was discovered in Ruoyi 4.8.1 allowing attackers to gain escalated privileges due to the owning department having higher rights than the active user.

References (2)

Core 2
Core References
Exploit, Issue Tracking, Vendor Advisory
https://gitee.com/y_project/RuoYi/issues/ICJ865

Scores

CVSS v3 8.8
EPSS 0.0006
EPSS Percentile 20.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-284
Status published
Products (1)
ruoyi/ruoyi 4.8.1
Published Nov 26, 2025
Tracked Since Feb 18, 2026