Threats tagged 'ghsa-rxv9-x3r4-pp2r'

ruoyi-ai versions 3.0.0 through 3.1.0 have a missing authorization vulnerability in the GET /workflow/search endpoint. Authenticated non-admin users can access this endpoint, which does not filter by owner or public status, allowing them to view private workflows of other users within the same tenant. The exposed data includes workflow UUIDs and full node and edge configurations. The vulnerability has a medium severity with a CVSS 4.0 score of 5.3.