CVE-2026-110107
Received Received - Intake

Insecure Direct Object Reference in RuoYi-Cloud-Plus Allows Social Login Deletion

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId}, which deletes sys_social rows by primary key without ownership checks, removing victims' OAuth tokens and blocking social login.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-110107
EUVD
EUVD-2026-98940

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dromara RuoYi-Cloud-Plus 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

RuoYi-Cloud-Plus through version 6.0.0 has an insecure direct object reference vulnerability. Authenticated users can delete other users' social login bindings by providing their socialId. The vulnerability occurs via a DELETE request to /auth/unlock/{socialId}, which removes sys_social rows by primary key without checking ownership. This deletes victims' OAuth tokens and blocks their social login access.

Detection Guidance

To detect this vulnerability, monitor HTTP DELETE requests targeting /auth/unlock/{socialId} with authenticated sessions. Check logs for unusual deletion of sys_social table entries or OAuth token removals. No specific commands are provided in the context.

Impact Analysis

If exploited, this vulnerability allows attackers to disrupt victims' social login access by deleting their OAuth tokens. Victims would be unable to log in via social accounts, potentially losing access to their accounts or services tied to those logins. It may also lead to account lockouts or forced password resets.

Compliance Impact

This vulnerability could impact compliance by potentially exposing user data or disrupting access controls. GDPR requires protecting user data and ensuring access rights; unauthorized deletion of OAuth tokens may violate these principles. HIPAA requires safeguarding protected health information; disruptions could affect data availability and integrity.

Mitigation Strategies

Immediately update RuoYi-Cloud-Plus to a patched version beyond 6.0.0. Implement ownership validation for DELETE /auth/unlock/{socialId} requests. Restrict DELETE permissions to authorized users only. Review sys_social table for unauthorized deletions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110107. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart