CVE-2026-108803: Session Expiration in y_project RuoYi

This vulnerability in y_project RuoYi up to version 4.8.3 impacts the changeStatus function of the /system/config/add Disable API component. The flaw allows remote attackers to manipulate the system to cause session expiration. The CVSS 4.0 base score is 5.3 (medium severity), indicating a network attack vector with low complexity and no user interaction required. The vendor was contacted but did not provide any response or remediation guidance. No known exploits or patches have been reported.

Successful exploitation results in session expiration, which could disrupt user sessions or application availability. The impact is limited to session management and does not indicate privilege escalation or data compromise. The vulnerability can be triggered remotely without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor official channels for updates. Until a fix is available, consider restricting access to the affected API or implementing compensating controls to protect session integrity.