Vulnerabilities

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST…

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/{uuid}. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them because softDelete() skips the PrivilegeUtil.checkAndGetByUuid() ownership check, removing owners' workflows.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Cisco

Product

ftd

CVSS

5.4

Exposure class

Edge / VPN / firewall

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-108112 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 3
   CVE NVD 28d ago

   ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private…

   CVSS 4.3 CVE-2026-108111