Listen to this Post
The CVE-2025-46174 vulnerability in Ruoyi v4.8.0 stems from an incorrect access control flaw in the resetPwd method of SysUserController.java. This method handles password resets for users but lacks the necessary checkUserDataScope permission check. The checkUserDataScope function verifies if the current user has appropriate data scope permissions to access or modify specific user data. Without this check, the resetPwd method bypasses critical authorization controls. Attackers with network access to the application can send crafted HTTP requests to the password reset endpoint. This typically involves POST requests to /system/user/resetPwd with a target user ID parameter. The vulnerability arises from missing @PreAuthorize annotations or similar security enforcements. In Ruoyi’s architecture, SysUserController manages user operations, and resetPwd should be restricted to administrators. However, the missing check allows any authenticated user to potentially reset passwords of others. This can lead to privilege escalation and unauthorized account takeovers. Exploitation requires knowing valid user IDs, which might be obtained through information leakage. The issue is particularly severe in multi-tenant environments where data isolation is essential. Code review reveals the omission of checkUserDataScope before calling sysUserService.resetPwd. Static analysis tools can flag such missing authorization checks. The vulnerability impacts confidentiality, integrity, and availability of user accounts. Fixing it involves adding the permission check to validate user data scope. Developers should ensure all data modification methods include proper access controls. Organizations must upgrade to a patched version to mitigate risk.
DailyCVE Form:
Platform: Ruoyi
Version: v4.8.0
Vulnerability: Incorrect Access Control
Severity: High
Date: 11/26/2025
Prediction: Patch Date TBD
What Undercode Say:
Analytics
grep -n “resetPwd” SysUserController.java
cat SysUserController.java | grep -A 5 “public.resetPwd”
curl -X POST /system/user/resetPwd -d “userId=123”
Code snippet vulnerable:
public AjaxResult resetPwd(Long userId) {
sysUserService.resetPwd(userId);
return success();
}
Fixed code snippet:
@PreAuthorize(“@ss.hasPermi(‘system:user:resetPwd’)”)
public AjaxResult resetPwd(Long userId) {
checkUserDataScope(userId);
sysUserService.resetPwd(userId);
return success();
}
How Exploit:
Send unauthorized POST request.
Craft request with user ID.
Bypass permission checks.
Reset victim password.
Protection from this CVE:
Upgrade Ruoyi version.
Add checkUserDataScope call.
Use @PreAuthorize annotations.
Implement role-based controls.
Impact:
Privilege escalation possible.
Unauthorized password resets.
Account takeover risk.
Data confidentiality breach.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
