CVE-2025-46174: Ruoyi

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Ruoyi v4.8.0 vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the resetPwd Method of SysUserController.java.

Affected products

• Ruoyi Ruoyi: version 4.8.0 only

Published 2025-11-26. Last modified 2026-06-17.