CVE-2026-110106: dromara ruoyi-vue-plus

Vulnerability summary

CVE-2026-110106 is a medium (CVSS 4.2) vulnerability in dromara ruoyi-vue-plus. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 19.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 13-10-2026
   PublishedVulnerability first disclosed.
2. 16-10-2026
   Last modifiedVulnerability information updated.

Description

RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId} requests with a victim's binding id to remove their GitHub, WeChat, or Gitee binding and stored OAuth tokens, blocking social login.

• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.