RuoYi Access Control Vulnerability in Department Data Management

An access control vulnerability has been identified in RuoYi version 4.8.2, specifically within the 'selectDept' function. This vulnerability allows unauthorized users to access sensitive department data without proper permission checks. Unlike other interfaces that manage department information and utilize the Shiro framework's permission annotations to enforce access controls, the affected function lacks these essential safeguards.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive department information.

Reproduction

The vulnerability can be reproduced by accessing the 'selectDept' function without the necessary permissions. This can be done through the department management interface, which is part of the RuoYi application.