Vulnerability · Published Sep 24, 2026 · Assigned by VulDB

CVE-2026-97324YunaiV/zhijiantianya ruoyi-vue-pro Demo-order Payment Callback PayDemoOrderController.java updateDemoOrderPaid improper authorization

High 7.3

In plain English

A high-severity security flaw in ruoyi-vue-pro from YunaiV. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.3%top 79.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/demo/PayDemoOrderController.java of the component Demo-order Payment Callback Handler. The manipulation of the argument ID leads to improper authorization. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
YunaiV	ruoyi-vue-pro	2026.08
zhijiantianya	ruoyi-vue-pro	2026.08

Weakness: CWE-285, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

References

VDB-409332 | YunaiV/zhijiantianya ruoyi-vue-pro Demo-order Payment Callback PayDemoOrderController.java updateDemoOrderPaid improper authorization vdb-entry, technical-description
VDB-409332 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-97324 | CVE Analysis and Report third-party-advisory
Submit #908275 | zhijiantianya ruoyi-vue-pro 2026.06 权限许可 third-party-advisory