CVE-2026-108111 Details

A missing authorization vulnerability has been identified in RuoYi AI versions 3.0.0 through 3.1.0. The issue resides in the GET /workflow/search endpoint, which lacks proper filtering for workflow ownership and public visibility. As a result, authenticated non-admin users can access private workflows belonging to other users within the same tenant. The exposed workflows include sensitive details such as UUIDs and full configurations of nodes and edges. This vulnerability allows for unauthorized enumeration of private workflows, potentially revealing confidential process logic or prompts, depending on the application's usage.

To address this vulnerability, the workflow search endpoint should be modified to include ownership or public visibility filters. Additionally, the workflow deletion process must be updated to verify ownership before allowing the deletion.