CVE-2026-108112 — ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via Workflow Delete Endpoint
ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/{uuid}. Attac…
Published: 2026-10-09 · CVSS: 5.3 · CVSS 4.0
ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/{uuid}. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them because softDelete() skips the PrivilegeUtil.checkAndGetByUuid() ownership check, removing owners' workflows.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7