CVE-2026-108112 Details

A missing authorization vulnerability has been identified in RuoYi AI versions 3.0.0 through 3.1.0. This vulnerability allows authenticated users to delete other users' workflows without proper ownership verification. The issue arises because the workflow deletion endpoint bypasses the necessary authorization checks, enabling one user to manipulate another user's workflow data. The vulnerability can be exploited by first retrieving workflow UUIDs from the generic workflow search endpoint, which lacks user-specific filtering, and then using those UUIDs to delete the corresponding workflows via the deletion endpoint.

The vulnerability can be addressed by modifying the workflow deletion endpoint to include ownership checks before allowing a workflow to be deleted. Additionally, the workflow search endpoint should be updated to filter results based on the user's permissions.