CVE-2026-110107

Published: Ott 13, 2026 Last Modified: Ott 13, 2026

ExploitDB:

Other exploit source:

Google Dorks:

LOW 2,3

Source: [email protected]

Attack Vector: network

Attack Complexity: low

Privileges Required: low

User Interaction: none

Confidentiality: N/A

Integrity: N/A

Availability: N/A

MEDIUM 4,2

Source: [email protected]

Attack Vector: network

Attack Complexity: high

Privileges Required: low

User Interaction: none

Scope: unchanged

Confidentiality: none

Integrity: low

Availability: low

Description

AI Translation Available

RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId}, which deletes sys_social rows by primary key without ownership checks, removing victims' OAuth tokens and blocking social login.