CVE-2026-110107: Authorization Bypass Through User-Controlled Key in dromara RuoYi-Cloud-Plus

CVE-2026-110107 describes an authorization bypass vulnerability in RuoYi-Cloud-Plus through version 6.0.0. Authenticated users can exploit an insecure direct object reference by sending a DELETE request to /auth/unlock/{socialId} with a socialId belonging to another user. The system deletes the corresponding sys_social database rows by primary key without verifying ownership, allowing attackers to remove other users' social login bindings and effectively block their OAuth-based login.

An attacker with authenticated access can delete social login bindings of other users, causing denial of social login access for those users. This impacts user convenience and potentially disrupts access but does not directly lead to privilege escalation or data disclosure. The overall severity is low.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to prevent unauthorized DELETE requests or implement additional ownership checks on the server side to validate socialId ownership before deletion.