CVE-2026-110107 Details

An insecure direct object reference (IDOR) vulnerability has been identified in RuoYi-Cloud-Plus versions through 6.0.0. This vulnerability allows authenticated users to delete other users' social login bindings by providing the corresponding social ID. The issue arises because the deletion endpoint, DELETE /auth/unlock/{socialId}, removes entries from the sys_social table based on the primary key without verifying ownership. As a result, attackers can disrupt victims' OAuth tokens and hinder their ability to log in using social accounts.

The vulnerability can be addressed by adding ownership checks to the deletion endpoint, ensuring that users can only delete their own social login bindings. This can be done by modifying the TokenController to verify the current user's identity before allowing the deletion.