CVE-2026-110106: RuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}
RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId} requests with a victim's binding id to remove their GitHub, WeChat, or Gitee binding and stored OAuth tokens, blocking social login.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs an authenticated account and a victim's social-login binding identifier (socialId). They can then send a DELETE request to the unlock endpoint using that identifier.
What is the practical impact on a targeted user?
The victim's GitHub, WeChat, or Gitee social-login binding can be removed, along with stored OAuth tokens for that binding. This can prevent the victim from using that social-login method.
Which versions should be considered affected?
RuoYi-Vue-Plus versions through 6.0.0 are identified as affected.