Missing Authorization Vulnerability in RuoYi AI Product by Ageerle
CVE-2026-108111
5.3MEDIUM
Key Information:
Badges
👾 Exploit Exists
What is CVE-2026-108111?
The RuoYi AI product versions 3.0.0 through 3.1.0 exhibit a missing authorization vulnerability within the GET /workflow/search endpoint. This flaw allows authenticated non-admin users to access and list other users' private workflows that should be protected. The absence of owner or is_public filtering enables unauthorized users to retrieve sensitive UUIDs and complete node and edge configurations across the same tenant, potentially leading to data exposure and privacy breaches.
Affected Version(s)
ruoyi-ai 3.0.0 <= 3.1.0
References
CVSS V4
Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved
Credit
HaiND from the Post and Telecommunication Institute of Technology