CVE-2026-108803: y_project RuoYi Disable API add changeStatus session expiration
A security vulnerability has been detected in yproject RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the component Disable API. The manipulation leads to session expiration. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects y_project RuoYi versions up to and including 4.8.3, specifically the Disable API's changeStatus function in /system/config/add.
What access does an attacker need?
The attack can be initiated remotely and requires low privileges. No user interaction is required.
What is the practical impact?
Successful manipulation can cause session expiration. The available scoring indicates low impacts to confidentiality, integrity, and availability.
Is a vendor fix available?
The provided information does not identify a fix. The vendor was contacted before disclosure but did not respond.