CVE-2025-10988 YunaiV ruoyi-vue-pro transfer improper authorization

Medium 5.3 Published 26 Sep 2025 Updated 27 Oct 2026

Attackers can bypass authorization checks in the CRM business transfer feature to modify data without proper permissions.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-10988?

CVE-2025-10988 is a medium-severity missing authorization vulnerability in YunaiV ruoyi-vue-pro, published on 26 Sep 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability was identified in YunaiV ruoyi-vue-pro up to 2025.09. This affects an unknown part of the file /crm/business/transfer. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit is publicly available and might be used. It is suggested to upgrade the affected component. The vendor confirms: "The controllers check the relevant update permission and obtain the acting user ID from the authenticated server context. The services require CRM OWNER permission and call transferPermission, which explicitly rejects a caller who is neither the owner nor an authorized CRM administrator."

Weakness: CWE-285, CWE-266

Which versions are affected by CVE-2025-10988?

It affects 1 product.

Products include Iocoder Ruoyi-Vue-Pro.

How do I fix CVE-2025-10988?

No fix has been published for CVE-2025-10988 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-10988 being exploited?

There is no known exploitation of CVE-2025-10988 in the wild and no public exploit code.

Sources

Also known as GHSA-x3pg-94gm-79p3.