Threat database

ruoyi-ai versions 3.0.0 through 3.1.0 have a missing authorization vulnerability that allows authenticated users to delete workflows owned by other users. This occurs because the softDelete() function bypasses the ownership check, enabling deletion via the POST /workflow/del/{uuid} endpoint when supplying workflow UUIDs obtained from GET /workflow/search.

ruoyi-ai versions 3.0.0 through 3.1.0 have a missing authorization vulnerability in the GET /workflow/search endpoint. Authenticated non-admin users can access this endpoint, which does not filter by owner or public status, allowing them to view private workflows of other users within the same tenant. The exposed data includes workflow UUIDs and full node and edge configurations. The vulnerability has a medium severity with a CVSS 4.0 score of 5.3.

A vulnerability was found in ageerle ruoyi-ai 2.0.0 and classified as critical. Affected by this issue is the function speechToTextTranscriptionsV2/upload of the file ruoyi-modules/ruoyi-system/src/main/java/org/ruoyi/system/service/impl/SseServiceImpl.java. The manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.1 is able to address this issue. The patch is identified as 4e93ac86d4891c59ecfcd27c051de9b3c5379315. It is recommended to upgrade the affected component.