CVE-2026-110107: RuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}
RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId}, which deletes syssocial rows by primary key without ownership checks, removing victims' OAuth tokens and blocking social login.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user who can send requests to the affected endpoint can exploit it. The attacker needs a target socialId value; no user interaction is required.
What is the practical impact on affected users?
An attacker can delete another user's social-login binding, including the associated OAuth token record. This can prevent the victim from using social login until the binding is restored.
Are unauthenticated deployments affected?
The described attack requires authentication, so an unauthenticated attacker cannot exploit it based on the available information. Any account with access to the endpoint may be sufficient because ownership is not checked.
How can defenders identify possible exploitation?
Review requests to DELETE /auth/unlock/{socialId} and correlate them with deletions of sys_social records. Deletions initiated by accounts other than the binding owner are indicative of exploitation.
What can be done before a patch is available?
Restrict access to the DELETE /auth/unlock/{socialId} endpoint or disable social-binding removal where feasible. A compensating control should verify that the authenticated user owns the socialId before deleting the corresponding sys_social record.