A remote attacker can manipulate the ID parameter in the updateDemoOrderPaid function of the Demo-order Payment Callback Handler, allowing the attacker to mark any order as paid. This flaw is a classic improper authorization issue (CWE-266 and CWE-285) that can be abused to tamper with financial records, potentially facilitating fraud and loss of accountability. The consequence is a direct breach of data integrity and could be leveraged for malicious financial actions within the application.

The vulnerability affects the YunaiV and Zhijiantianya versions of the ruoyi-vue-pro component, specifically any release up to and including 2026.08. Users running these deployments, which contain the PayDemoOrderController.java module in the yudao-module-pay component, are impacted.

The flaw has a CVSS score of 6.9, indicating a moderate severity. The exploit is publicly available and can be triggered from a remote location without local authentication, implying a straightforward attack vector over the network. While EPSS data is not available, the lack of a KEV listing does not reduce the risk; the flawed authorization logic remains exploitable for any remote actor who can reach the callback endpoint.