CVE-2026-108112

MediumCVSS 5.4

Published: 09/10/2026(UTC)Updated: 14/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

11th percentile - higher than 11% of all known CVEs

Summary

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/{uuid}. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them because softDelete() skips the PrivilegeUtil.checkAndGetByUuid() ownership check, removing owners' workflows.

Risk Assessment

An authenticated user can delete workflows belonging to others, causing data loss and operational disruption. This may compromise system integrity and availability.

Recommendation

Update ruoyi-ai to a patched version. In the meantime, restrict access to workflow endpoints and monitor for unauthorized deletion attempts.

Other vulnerabilities in ruoyi-ai

CVE-2026-108111Medium
ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticated non-admin users can query this endpoint, which lacks owner or is_public filtering, to list enabled private workflows in the same tenant, including UUIDs and full node and edge configurations.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS