CVE-2026-110107

RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId, which deletes syssocial rows by primary key without...

CVE-2026-110106

RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId requests with a victim's binding id to remove their...

CVE-2026-110107 RuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}

RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId, which deletes syssocial rows by primary key without...

CVE-2026-110107 RuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}

RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId, which deletes syssocial rows by primary key without...

CVE-2026-110107

RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId, which deletes syssocial rows by primary key without...

CVE-2026-110107

Versions of RuoYi-Cloud-Plus through 6.0.0 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability. The flaw exists because the application fails to perform ownership checks when processing the DELETE /auth/unlock/{socialId} request. An authenticated attacker can exploit this b...

CVE-2026-110107 RuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}

RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId, which deletes syssocial rows by primary key without...

EUVD-2026-98940

RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId, which deletes syssocial rows by primary key without...

CVE-2026-110106 RuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}

RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId requests with a victim's binding id to remove their...

CVE-2026-110106 RuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}

RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId requests with a victim's binding id to remove their...

CVE-2026-110106

RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId requests with a victim's binding id to remove their...

EUVD-2026-98939

RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId requests with a victim's binding id to remove their...

CVE-2026-110106

Versions of RuoYi-Vue-Plus through 6.0.0 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability. This flaw allows authenticated users to delete the social login bindings of other users by providing a specific socialId . Specifically, an attacker can send a DELETE /auth/unlock/...

PT-2026-111700

Name of the Vulnerable Software and Affected Versions RuoYi-Vue-Plus versions prior to 6.0.1 Description An insecure direct object reference allows authenticated users to delete social login bindings of other users. By sending a request to the endpoint "/auth/unlock/socialId" using a victim's...

CVE-2026-110107: Authorization Bypass Through User-Controlled Key

RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId, which deletes syssocial rows by primary key without...

CVE-2026-110106: Authorization Bypass Through User-Controlled Key

RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId requests with a victim's binding id to remove their...

PT-2026-111701

RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId, which deletes sys social rows by primary key without...