RUoYi Privilege Escalation Vulnerability in selectDeptTree Method

A privilege escalation vulnerability exists in RUoYi version 4.8.0. The issue arises in the selectDeptTree method of the /selectDeptTree/{deptId} endpoint, where the deptId parameter is not properly validated. This lack of validation allows remote attackers to manipulate the deptId parameter to escalate privileges.

Impact

Exploitation of this vulnerability allows for unauthorized privilege escalation, potentially leading to elevated access rights within the application.