The vulnerability resides in the CRM module’s GET /admin-api/crm/follow‑up‑record/get endpoint of ruoyi‑vue‑pro. It is a missing authorization flaw that permits any authenticated user to request records by iterating sequential numeric identifiers. Attackers can retrieve private follow‑up notes, file attachments, scheduling details, and business entity references belonging to other users. This results in a confidentiality breach without affecting integrity or availability.

Yunai’s ruoyi‑vue‑pro, version 2026.05 and earlier. The issue is fixed in commit c779a47, so systems running that version or any older release are vulnerable.

The CVSS v3 score of 7.1 classifies the risk as medium, and the vulnerability is readily exploitable because it only requires an authenticated user and simple enumeration of numeric IDs. EPSS data is not available, but the exposure of sensitive personal and business information makes the risk significant. The vulnerability is not listed in CISA’s KEV catalog. Exploitation can be achieved by sending crafted GET requests to the endpoint with arbitrary ID values, bypassing proper access checks.