paascloud/paascloud-master · error · UacBizException

UAC10011023

UAC10011023

Error message

越权操作

What it means

UacBizException UAC10011023 ('越权操作' / unauthorized operation) thrown by UacRoleServiceImpl.bindAction when the target roleId equals GlobalConstant.Sys.SUPER_MANAGER_ROLE_ID. Modifying the permissions of the built-in super-admin role is forbidden to prevent privilege escalation beyond the fixed super role.

Solutions

1. Exclude the super role from assignable role lists in the UI/API responses
2. Check roleId against SUPER_MANAGER_ROLE_ID in the client before submitting
3. Treat this as a security signal — log and review the caller if unexpected

Example fix

// before
uacRoleService.bindAction(new RoleBindActionDto(GlobalConstant.Sys.SUPER_MANAGER_ROLE_ID, actionIds));
// after
if (Objects.equals(roleId, GlobalConstant.Sys.SUPER_MANAGER_ROLE_ID)) {
    throw new IllegalArgumentException("super manager role is immutable");
}
uacRoleService.bindAction(new RoleBindActionDto(roleId, actionIds));

if (Objects.equals(roleId, GlobalConstant.Sys.SUPER_MANAGER_ROLE_ID)) {
    return Result.error("超级管理员角色不允许修改权限");
}

boolean isSuperManagerRole(Long roleId) { return Objects.equals(roleId, GlobalConstant.Sys.SUPER_MANAGER_ROLE_ID); }

try {
    uacRoleService.bindAction(dto);
} catch (UacBizException e) {
    if (ErrorCodeEnum.UAC10011023.getCode().equals(e.getCode())) {
        logger.warn("attempt to modify super manager role, roleId={}", dto.getRoleId());
        return Result.error("越权操作");
    }
    throw e;
}

When it happens

Trigger: Calling bindAction with the super-manager role ID as target — an attempt to add/remove permissions on the system super role.

Common situations: Admin UI not hiding the super role from the permission-assignment screen; scripted role-management hitting the protected ID; an attacker probing the endpoint.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• UAC10012003
• UAC10012001
• UAC10012001
• UAC10012005
• UAC10011001

AI-assisted analysis of paascloud/paascloud-master@781281a950 (2026-09-10). Data as JSON: /api/errors/4ec2dc9e4102e5a1. Report an issue: GitHub.

Appendix: source

Thrown at paascloud-provider/paascloud-provider-uac/src/main/java/com/paascloud/provider/service/impl/UacRoleServiceImpl.java:129

		for (MenuCountVo vo : menuCountVos) {
			noCheckedMenu.add(vo.getId());
		}

		return noCheckedMenu;
	}

	@Override
	public void bindAction(RoleBindActionDto grantAuthRole) {
		Long roleId = grantAuthRole.getRoleId();
		Set<Long> actionIdList = grantAuthRole.getActionIdList();

		if (roleId == null) {
			throw new UacBizException(ErrorCodeEnum.UAC10012001);
		}

		if (Objects.equals(roleId, GlobalConstant.Sys.SUPER_MANAGER_ROLE_ID)) {
			logger.error("越权操作, 超级管理员用户不允许操作");
			throw new UacBizException(ErrorCodeEnum.UAC10011023);
		}

		UacRole uacRole = uacRoleMapper.selectByPrimaryKey(roleId);

		if (uacRole == null) {
			logger.error("找不到角色信息. roleId={}", roleId);
			throw new UacBizException(ErrorCodeEnum.UAC10012005, roleId);
		}

		// TODO 校验参数的合法性(这里不写了 累得慌 也就是校验菜单和权限是否存在)
		List<UacRoleAction> uacRoleActionList = uacRoleActionService.listByRoleId(roleId);

		if (PublicUtil.isNotEmpty(uacRoleActionList)) {
			uacRoleActionService.deleteByRoleId(roleId);
		}

		if (PublicUtil.isEmpty(actionIdList)) {
			logger.error("传入按钮权限Id为空, 取消所有按钮权限");

View on GitHub (pinned to 781281a950)