A defect in an unknown function of yangzongzhuan RuoYi 4.8.3 enables a remote attacker to forge state‑changing requests without the target’s knowledge, leading to unauthorized actions on behalf of legitimate users. This flaw, identified as a cross‑site request forgery (CWE‑352) and potentially exacerbated by an authorization bypass (CWE‑862), can compromise the integrity of user data and application state.

The vulnerable component is distributed by yangzongzhuan under the product name RuoYi, with affected installations specifically reported in version 4.8.3. Current patch information is not included in the advisory, so any deployment of this release should be considered vulnerable.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is currently unavailable; the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, with an attacker leveraging a web browser or automated client to send forged requests. Exploitation requires access to the web interface, but no local privilege or authentication bypass is explicitly indicated in the description.