CVE-2026-108800
4.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-352, CWE-862
Impact
Remote attackers can trick an authenticated RuoYi user into executing unwanted state-changing actions via cross-site request forgery. They need an authenticated user to click a malicious link or visit a malicious webpage.
Root cause
The application fails to implement anti-CSRF protections or proper authorization checks on state-changing requests.
Affected systems
yangzongzhuan RuoYi 4.8.3
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Fix & remediation
No official fixed version is currently listed by the vendor. Restrict network access to the RuoYi application or place a reverse proxy/WAF in front to enforce strict Origin/Referer header checks and SameSite cookie policies.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability was identified in yangzongzhuan RuoYi 4.8.3. The affected element is an unknown function. Such manipulation leads to cross-site request forgery. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.