This flaw lives in RuoYi’s checkRoleAllowed function in the role‑management API. By manipulating the roleKey argument, an attacker can bypass normal authority checks. The result is that the attacker is able to operate with a higher privilege level than intended, which opens the door to unauthorized access to resources or actions within the application. The vulnerability’s impact is confined to privilege escalation: the attacker cannot directly alter data or compromise the underlying system unless they already have access to modify the RuoYi configuration.

The issue affects versions of the yangzongzhuan RuoYi application up to and including 4.8.3. Users running these releases on any platform are potentially exposed; no additional hardware or software constraints are documented.

The CVSS score of 5.3 indicates a moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be remote HTTP or API access to the /system/role/authDataScope endpoint, where an attacker supplying a crafted roleKey can trigger the privilege escalation. When the vendor has not yet released a patch, the risk remains elevated for any systems that expose the affected endpoint to untrusted users.