RuoYi Insecure Role Assignment Vulnerability Allowing Privilege Escalation

A vulnerability in RuoYi version 4.8.0 allows authenticated users to escalate privileges by assigning themselves higher-level roles. The issue arises because the role assignment interface fails to properly validate whether the new role has greater privileges than the current one. As a result, users can manipulate their roles to gain unauthorized access to additional functionalities.

Impact

Exploitation of this vulnerability allows for unauthorized privilege escalation, enabling users to gain access to higher-level roles and associated permissions within the application.

Reproduction

To reproduce this vulnerability, an authenticated user with a low-privilege role can access the user role assignment interface. The user can then select a role with higher privileges and assign it to themselves. This process bypasses the intended role validation, leading to unauthorized access.