CVE-2026-108803
6.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-613
Impact
Authenticated remote attackers can cause session expiration issues or alter state by manipulating the configuration disable API. They require network access and a valid low-privileged account.
Root cause
The changeStatus function in /system/config/add suffers from improper session expiration handling (CWE-613).
Affected systems
y_project RuoYi up to 4.8.3
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
No official patched version is listed. Restrict network access to the RuoYi administrative endpoints or block access to /system/config/add at the reverse proxy or WAF until a patch is released.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A security vulnerability has been detected in y_project RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the component Disable API. The manipulation leads to session expiration. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.