The exposed API in SysUserServiceImpl.selectUserListByDept permits any authenticated user with the system:user:list authority to request user information from departments other than their own. The vulnerability is an authorization bypass that allows retrieval of usernames, nicknames, account status, last login IP and time, and remarks for users in any department provided its ID. This can lead to confidential user data becoming accessible to unauthorized personnel and could facilitate social engineering or credential theft.

The flaw affects RuoYi-Vue-Plus versions up to and including 6.0.0, distributed by dromara. No additional version details are available. Systems running any of these releases should be reviewed for this exposure.

The CVSS base score of 5.3 indicates a moderate risk level. Because the vulnerability requires that an attacker already have an authenticated session with system:user:list permissions, the primary attack vector is internal or post‑compromise. EPSS data is absent, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers can trigger it by sending a GET request to /system/user/list/dept/{deptId} with arbitrary department IDs. No additional conditions such as elevated privileges beyond the listed authority are required.