CVE-2026-110107

4.2Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.2Medium

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-639

Impact

Authenticated attackers can unlink any user's social login and delete their OAuth tokens, breaking third-party authentication for targets. They only need a valid user account and network access to the API.

Root cause

The DELETE /auth/unlock/{socialId} endpoint removes records directly by primary key without verifying that the targeted socialId belongs to the caller.

Affected systems

RuoYi-Cloud-Plus through 6.0.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

Fix & remediation

No fixed version is specified; patch the TokenController unlock endpoint to validate user ownership against sys_social before deletion, or block/restrict DELETE requests to /auth/unlock/* at your gateway as a temporary mitigation.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId}, which deletes sys_social rows by primary key without ownership checks, removing victims' OAuth tokens and blocking social login.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110107