ruoyi-ai SysNoticeController improper authorization (CVE-2025-3202)
The SysNoticeController component in ageerle's ruoyi-ai open source AI development platform reportedly has an unauthorized access vulnerability allowing attackers to modify and query notification information without credentials. The vulnerability was reportedly discovered through automated AI code auditing of the project's latest code as of March 29, 2025.
What happened
The SysNoticeController component in the ruoyi-ai project has an unauthorized access vulnerability in three API endpoints: /list, /getNotice, and /edit that can be accessed without authentication.
Although the system has authenticated sensitive API interfaces to prevent illegal access, the API interfaces used to modify and query system announcement information can still be accessed by unauthorized persons.
The vulnerability was discovered through automated AI code auditing of the project's latest code as of March 29, 2025.
Reported impact
Attackers can modify and query the notification information sent to users by the management system without any access credentials.
The vulnerability damages the confidentiality, integrity and availability of the system.
Index analysis
The vulnerability code entry point is located in SysNoticeController.java, which exposes three API endpoints without proper authorization checks.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.