Insecure Direct Object Reference in RuoYi-Cloud-Plus Affects User Security
CVE-2026-110107

2.3LOW

Key Information:

Vendor

Dromara

Status
Ruoyi-cloud-plus
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110107?

RuoYi-Cloud-Plus versions up to 6.0.0 are vulnerable to an insecure direct object reference, permitting authenticated users to delete other users' social login bindings. By crafting a DELETE request to /auth/unlock/{socialId}, attackers can bypass ownership checks and remove OAuth tokens tied to victims, effectively blocking their access to social login functionalities. This critical flaw threatens user security and necessitates immediate remediation.

Affected Version(s)

RuoYi-Cloud-Plus 0 <= 6.0.0

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ruoyi-cloud-plu...
third-party-advisory
https://github.com/dromara/RuoYi-Cloud-Plus/blob/27a79a10...
technical-description
https://github.com/dromara/RuoYi-Cloud-Plus/blob/27a79a10...
technical-description

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.