Insufficient Session Expiration in y_project RuoYi up to 4.8.3
CVE-2026-108803

5.3MEDIUM

Key Information:

Vendor

Y Project

Status
Ruoyi
Vendor
CVE Published:
12 October 2026

What is CVE-2026-108803?

A security vulnerability exists in y_project RuoYi versions up to 4.8.3, affecting the changeStatus function of the Disable API component. This flaw may lead to session expiration issues, allowing attackers to execute unauthorized actions remotely. The vendor has been notified about this issue; however, there has been no response from them regarding the mitigation of this risk. Users of affected versions are advised to assess their security posture and implement necessary safeguards.

Affected Version(s)

RuoYi 4.8.0

RuoYi 4.8.1

RuoYi 4.8.2

References

https://vuldb.com/vuln/416580
vdb-entrytechnical-description
https://vuldb.com/vuln/416580/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108803
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

bobtao666 (VulDB User)
VulDB CNA Team
.