CVE-2025-28410: Improper Access Control

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the cancelAuthUserAll method does not properly validate whether the requesting user has administrative privileges...

CVE-2025-28410

A privilege escalation vulnerability exists in RUoYi v.4.8.0 , a backend management system. The issue stems from the cancelAuthUserAll method failing to properly validate whether the requesting user possesses administrative privileges . A remote attacker could exploit this lack of access control ...