CVE-2026-108112

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/uuid. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them because softDelete skips the...

CVE-2026-108112

The ruoyi-ai software, versions 3.0.0 through 3.1.0 , is vulnerable to a missing authorization flaw (CWE-862). Authenticated users can delete workflows belonging to other users via the POST /workflow/del/{uuid} endpoint. The root cause is that the softDelete() function fails to invoke the Privile...