RUoYi Privilege Escalation Vulnerability in SysDictTypeController Component

A privilege escalation vulnerability has been identified in RUoYi version 4.8.0. The issue arises in the SysDictTypeController component, where a remote attacker can exploit inadequate access controls to escalate privileges. This vulnerability allows unauthorized users to modify dictionary records that may contain sensitive information such as user roles and permissions.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in user roles and permissions, allowing attackers to gain elevated privileges and manipulate system settings or behaviors.

Reproduction

To reproduce this vulnerability, a normal user must access the '/editSave' method in the 'SysDictTypeController' component. Once there, the user can send a request to modify dictionary records. The lack of proper permission checks enables unauthorized users to alter data that could impact user roles and system configurations.