CVE-2025-3199 is a high severity (CVSS 7.3) improper authorization flaw in ageerle ruoyi-ai up to version 2.0.1. The model management API controller can be reached without proper access checks. The record says upgrading to version 2.0.2 addresses it, so move to 2.0.2 or later and review your model settings.
What's affected
The NVD record covers ruoyi-ai up to and including 2.0.1. The file named is ruoyi-modules/ruoyi-system/src/main/java/org/ruoyi/system/controller/system/SysModelController.java, part of the API interface component. The weakness classes are CWE-266 (incorrect privilege assignment) and CWE-285 (improper authorization).
The record says upgrading to version 2.0.2 addresses the issue and names a patch commit, c0daf641fb25b244591b7a6c3affa35c69d321fe. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, so the flaw is reachable over the network with no login, and it rates low on confidentiality, integrity and availability.
The record also says the exploit has been disclosed publicly. It is not on the CISA Known Exploited Vulnerabilities list, and the sources reviewed do not report attacks in the wild.
How to check if you're exposed
Start with the version you run. If you deploy from a release package, check the release tag. If you build from the main branch, check the commit date and whether it includes the commit above.
git log -1 c0daf64
git describe
If the first command reports an unknown revision and your tag is below v2.0.2, treat the deployment as affected. Then look at the model management endpoints on your running instance. The upstream issue discussion describes the controller as allowing changes to the large model configuration, so any instance that is reachable by people who should not manage models needs attention.
If ruoyi-ai is only one project among many in your estate, list every service that embeds it, because the vulnerable controller ships inside the application and not as a separate package.
What to do now
- Upgrade ruoyi-ai to version 2.0.2 or later. The release notes for v2.0.1 also list a fix that limits changes to model information to logged in users, so 2.0.2 includes that line of work as well.
- Until the upgrade is done, keep the admin and system APIs off the public internet, or require a VPN.
- Review the model configuration for changes you did not make. Pay attention to endpoints, model names and any stored keys.
- Rotate API keys for upstream model providers if they are stored in this configuration. The 2.0.1 notes also mention masking key values in model management.
- Add this application to your inventory with its version, so the next advisory is easy to match.
The free in-browser dependency scan takes a manifest or lockfile and lists known CVEs for the packages in it, and the Gold directory lets you look up a CVE by id.
Why it matters
Authorization bugs are about the question a server must ask on every request: is this caller allowed to do this? Here the record says the answer was never checked for the model controller, so anyone who could send the request could manage settings that should belong to administrators.
In an AI platform, model settings are sensitive. They decide which provider receives your prompts and which credentials are used. Missing authorization on that surface can mean changed behaviour, exposed keys or unexpected cost. The fix pattern is to enforce authentication and a role check in one place, so a new controller cannot ship without it.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2025-3199?
The record says upgrading to 2.0.2 addresses it. Check the project's releases page for anything newer.
Does it need a login to reach?
The CVSS vector lists no privileges required, so the flaw is reachable without authentication on affected versions.
Sources
Last reviewed: 19 October 2026.
