CVE-2026-110106 Details

An insecure direct object reference vulnerability has been identified in RuoYi-Vue-Plus versions through 6.0.0. This vulnerability allows authenticated users to delete other users' social login bindings by providing the victims' social IDs. The issue arises in the 'AuthController' where the 'unlockSocial' endpoint, annotated with '@SaIgnore', only checks for a valid login without verifying ownership of the social ID being deleted. As a result, any authenticated user can remove another user's binding from GitHub, WeChat, or Gitee, along with the associated OAuth tokens, effectively blocking social login for the victim.

The vulnerability can be fixed by adding an ownership check to the 'unlockSocial' method in the 'AuthController', ensuring that users can only delete their own social login bindings. Additionally, the 'deleteWithValidById' method in the 'SysSocialServiceImpl' should be updated to include a check for the current user's ID before performing the deletion.