2.3
Faible
CVE-2026-110106 RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated…
Description
RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId} requests with a victim's binding id to remove their GitHub, WeChat, or Gitee binding and stored OAuth tokens, blocking social login.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| RuoYi-Vue-Plus 6.0 | premières → 6.0.0 | Pas de correctif indiqué |
Autres CVE de RuoYi-Vue-Plus
Les 6 CVE de RuoYi-Vue-Plus →
CVE-2026-119647
RuoYi-Vue-Plus through 6.0.0 Data-Scope Bypass via /system/user/list/dept/{deptId}
5.3
Moyenne
CVE-2026-77795
A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2
5.3
Moyenne
CVE-2026-58176
RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management endpoints under /workflow/task…
6.5
Moyenne
CVE-2026-2819
A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.5.3
5.3
Moyenne