Vulnerabilities

RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social…

RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId} requests with a victim's binding id to remove their GitHub, WeChat, or Gitee binding and stored OAuth tokens, blocking social login.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

GitHub

Product

github

CVSS

4.2

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-110106 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 3
   CVE NVD 18d ago

   Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access…

   CVSS 5.4 CVE-2026-110120
2. 10
   CVE NVD 18d ago

   Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to…

   CVSS 7.1 CVE-2026-110119
3. 3
   CVE NVD 18d ago

   RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users'…

   CVSS 4.2 CVE-2026-110107