Description
ruoyi-vue-pro through 2026.05, fixed in commit c779a47, contains a missing authorization vulnerability in the CRM module's GET /admin-api/crm/follow-up-record/get endpoint that allows authenticated users to read any follow-up record by iterating sequential numeric IDs. Attackers can exploit this by sending requests with arbitrary ID parameters to access other users' follow-up notes, file attachments, scheduling information, and business entity references without proper authorization checks.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Yunai ruoyi-vue-pro
Default version status: unaffected
0 to ≤ 2026.05affectedc779a476617c58a38904191094d22df254b42542unaffected
pkg:github/YunaiV/ruoyi-vue-pro