CVE-2025-28409
Published: 07 April 2025
Summary
CVE-2025-28409 is a high-severity Improper Access Control (CWE-284) vulnerability in Ruoyi Ruoyi. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 19.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2025-28409 is an improper access control vulnerability in RuoYi version 4.8.0. The flaw resides in the add method of the /add/{parentId} endpoint, which fails to verify that an authenticated user is authorized to create a menu item beneath the supplied parent identifier.
An attacker with low-privileged network access can invoke the endpoint with an arbitrary parentId value, bypassing intended permission checks and escalating to higher privileges. Successful exploitation yields full control over confidentiality, integrity, and availability of the affected application, consistent with the CVSS 8.8 rating.
The provided references point to the upstream RuoYi repository and a public disclosure repository but contain no explicit mitigation guidance or patch details. The associated EPSS scores remain low, with a current value of 0.0137 and a peak of 0.0181.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-10358
Vulnerability details
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the add method of the /add/{parentId} endpoint does not properly validate whether the requesting user has permission to add a menu item under the specified parentId
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables privilege escalation via improper permission validation in the /add/{parentId} endpoint of the RUoYi web application, directly facilitating T1068: Exploitation for Privilege Escalation.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
The access control policy and procedures directly mandate and enforce proper access control mechanisms across the organization.
Device lock enforces restricted access until re-authentication, directly reducing unauthorized use of active sessions.
Supervision and review of access control activities directly detects and remediates improper access configurations or usages.
Explicitly identifying and documenting actions permitted without identification or authentication enforces proper access control boundaries by defining justified exceptions.
By automatically labeling outputs with security attributes, the control supports attribute-based enforcement and reduces exploitability of improper access control weaknesses.
Associating and retaining security attributes with data directly supports enforcement of access control decisions across storage, processing, and transmission.
Requiring prior authorization for each remote access type prevents improper access control over remote connections.
Requiring authorization of wireless access before allowing connections enforces proper access control for this access method.