Ruoyi Incorrect Access Control Vulnerability in User Password Reset Function

An access control vulnerability has been identified in Ruoyi version 4.8.0. The issue arises from a missing permission check in the password reset method of the SysUserController. This oversight allows unauthorized users to potentially access and read information about other users, leading to unauthorized information disclosure.

Impact

Exploitation of this vulnerability could result in unauthorized access to user information, allowing an attacker to read sensitive data about other users without proper permission.