CVE-2026-110106
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId} requests with a victim's binding id to remove their GitHub, WeChat, or Gitee binding and stored OAuth tokens, blocking social login.
Risk Assessment
The risk includes blocking users' access through popular social platforms, potentially leading to account loss or identity takeover.
Recommendation
Verify ownership of the binding before deletion and protect the DELETE /auth/unlock/{socialId} endpoint from unauthorized access.
Other vulnerabilities in RuoYi-Vue-Plus
See all- CVE-2025-66916Critical
The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but it does not filter user input, allowing attackers to use the File class to perform arbitrary file reading and writing.
- CVE-2026-88616High
An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process, Warm-Flow TaskService.skip, POST /workflow/task/completeTask components.
- CVE-2026-58176Medium
In RuoYi-Vue-Plus up to version 5.6.2 (fixed in commit 88d03d9), workflow task management endpoints in FlwTaskController lack any permission checks. Any authenticated user, regardless of role, can reassign tasks, urge them, and list all pending and finished tasks.
Original NVD description (English source)
RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId} requests with a victim's binding id to remove their GitHub, WeChat, or Gitee binding and stored OAuth tokens, blocking social login.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS