CVE-2026-110106Published
RuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-110106 · Microsoft / collected KEV context
cve-program · CVE-2026-110106
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ruoyi-vue-plus-social-unbind-idor
- https://github.com/dromara/RuoYi-Vue-Plus/blob/7180b529776834fee912113b23f0bd7a387a8222/ruoyi-admin/src/main/java/org/dromara/web/controller/AuthController.java#L156-L162
- https://github.com/dromara/RuoYi-Vue-Plus/blob/7180b529776834fee912113b23f0bd7a387a8222/ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/service/impl/SysSocialServiceImpl.java#L116-L118
- https://github.com/dromara/RuoYi-Vue-Plus
- https://www.vulncheck.com/advisories/ruoyi-vue-plus-through-6.0.0-idor-via-delete-auth-unlock-socialid
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.