CVE-2026-110107

RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId, which deletes syssocial rows by primary key without...

CVE-2026-110107

Versions of RuoYi-Cloud-Plus through 6.0.0 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability. The flaw exists because the application fails to perform ownership checks when processing the DELETE /auth/unlock/{socialId} request. An authenticated attacker can exploit this b...