2.3
Low
CVE-2026-110106 RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated…
Description
RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId} requests with a victim's binding id to remove their GitHub, WeChat, or Gitee binding and stored OAuth tokens, blocking social login.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| RuoYi-Vue-Plus 6.0 | earliest → 6.0.0 | No fix stated |
Other CVEs of RuoYi-Vue-Plus
The 6 CVEs of RuoYi-Vue-Plus →
CVE-2026-119647
RuoYi-Vue-Plus through 6.0.0 Data-Scope Bypass via /system/user/list/dept/{deptId}
5.3
Medium
CVE-2026-77795
A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2
5.3
Medium
CVE-2026-58176
RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management endpoints under /workflow/task…
6.5
Medium
CVE-2026-2819
A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.5.3
5.3
Medium