RuoYi-Cloud-Plus IDOR lets users unlink others' social logins
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
RuoYi-Cloud-Plus through 6.0.0 is affected by an insecure direct object reference that lets an authenticated user delete other users' social login bindings by supplying their socialId. The flaw is an authorization bypass through a user-controlled key (CWE-639), since the DELETE /auth/unlock/{socialId} endpoint deletes sys_social rows without ownership checks. An attacker with low privileges and a valid account can remove victims' OAuth tokens and block their social login, which affects integrity and availability.
Written with Claude Haiku 5.5 from the sources below · 2026-10-27
Description from the CNA
RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId}, which deletes sys_social rows by primary key without ownership checks, removing victims' OAuth tokens and blocking social login.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for RuoYi-Cloud-Plus.
Written with Claude Haiku 5.5 from the sources below · 2026-10-27
Timeline
- 2026-10-13 Threatist record created from CVE-2026-110107
- 2026-10-13 Alias added: GHSA-qfpm-hv5j-w5q6
- 2026-10-14 CISA SSVC decision points changed
- 2026-10-14 Priority changed: LOW → MEDIUM
References
Other 3
- https://github.com/dromara/RuoYi-Cloud-Plus/blob/27a79a10e25b120aa33799d0dd4c720d1c8cf631/ruoyi-auth/src/main/java/org/dromara/auth/controller/TokenController.java#L149-L153
- https://github.com/dromara/RuoYi-Cloud-Plus/blob/27a79a10e25b120aa33799d0dd4c720d1c8cf631/ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/service/impl/SysSocialServiceImpl.java#L111-L113
- https://github.com/dromara/RuoYi-Cloud-Plus
More dromara vulnerabilities
- TI-2023-28043 HertzBeat AviatorScript Inject RCE CVSS 3.1CRITICAL 9.8
- TI-2023-24001 An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to… CVSS 3.1CRITICAL 9.8
- TI-2023-15126 Dromara Sureness before v1.0.8 was discovered to use a hardcoded key. CVSS 3.1CRITICAL 9.8
- TI-2025-41084 The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface… CVSS 3.1CRITICAL 9.4
- TI-2026-62126 lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint CVSS 4.0HIGH 8.7
- TI-2023-28044 HertzBeat SnakeYAML Deser RCE CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-110107 · CVE Program
- CVE-2026-110107 · NVD
- FIRST EPSS
- GHSA-qfpm-hv5j-w5q6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences