CVE-2025-70985: Ruoyi

Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their scope.

Affected products

• Ruoyi Ruoyi: version 4.8.1 only; version 4.8.2 only

Published 2026-01-23. Last modified 2026-06-17.