Vulnerabilities

RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users'…

RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId}, which deletes sys_social rows by primary key without ownership checks, removing victims' OAuth tokens and blocking social login.

Read at NIST National Vulnerability Database (CVE API 2.0)

CVSS

4.2

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-110107 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 3
   CVE NVD 18d ago

   Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access…

   CVSS 5.4 CVE-2026-110120
2. 10
   CVE NVD 18d ago

   Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to…

   CVSS 7.1 CVE-2026-110119
3. 3
   CVE NVD 18d ago

   RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social…

   CVSS 4.2 CVE-2026-110106 GitHub