CVE-2026-122016 | yangzongzhuan RuoYi-Vue up to 3.9.2 Permission Service SysPermissionService.java SysPermissionService.getMenuPermission perms privileges management (Issue 206)

November 4, 2026 Yanac

A vulnerability identified as critical has been detected in yangzongzhuan RuoYi-Vue up to 3.9.2. This issue affects the function SysPermissionService.getMenuPermission of the file SysPermissionService.java of the component Permission Service. This manipulation of the argument perms causes improper privilege management.

This vulnerability appears as CVE-2026-122016. The attack may be initiated remotely. There is no available exploit.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More