ZeroDay Findings
Sign inSign up

Findings

CVE-2026-110107

RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings…

Published Oct 13, 2026 · updated Oct 14, 2026

RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId}, which deletes sys_social rows by primary key without ownership checks, removing victims' OAuth tokens and blocking social login.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 13, 2026 · NIST NVD

    Detected

    RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId}, which deletes sys_social rows by primary key without ownership checks, removing victims' OAuth tokens and blocking social login.

  2. Oct 14, 2026 · NIST NVD

    Updated

    RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId}, which deletes sys_social rows by primary key without ownership checks, removing victims' OAuth tokens and blocking social login.

Sources

  • CVE.orgVulnerability recordCVE-2026-110107

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-110107

    30-day exploitation probability 0.3%

    first.org
  • NIST NVDVulnerability recordCVE-2026-110107

    RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId}, which deletes sys_social rows by

    nvd.nist.gov

References