CVE-2026-110107: RuoYi-Cloud-Plus IDOR in social-account unbind endpoint allows unauthorized account unbinding

CVE-2026-110107: RuoYi-Cloud-Plus: the social-account unbind endpoint deletes a third-party login binding by primary key with no owner check, so any authenticated user can unbind another user's account Vulnerability Overview RuoYi-Cloud-Plus is a multi-user microservice management platform. Authentication is handled by Sa-Token in the Spring Cloud gateway, which forwards authenticated requests to backend services. Users can bind third-party identities (WeChat, Gitee, GitHub, DingTalk, MaxKey, TopIAM, etc.), and the binding records are stored in the table within the service. The unbind endpoint in lacks permission annotations and performs no ownership checks. It passes the from the path directly to the Dubbo service method , which forwards to , where is executed. This deletion filters solely by primary key and never restricts rows to the caller; there are no data permission annotations on the mapper, and this version does not include tenant isolation rows. Although the method name contains the word "Valid," the implementation performs no validation, and the associated hook is an empty stub. This boundary is breached because the same codebase enforces it for reads. The read path limits results to the current user via , ensuring a user sees only their own bindings. The unbind path has no equivalent scope restriction. Any authenticated account, including those with minimal privileges, can thus delete any other user's social login bindings by providing that binding's . The actual impact is limited by the fact that is a Snowflake ID and is not exposed via any HTTP endpoint for other users; therefore, exploitation requires knowledge of the target identifier rather than simple sequential enumeration. Impact Scope Project: dromara/RuoYi-Cloud-Plus, microservice admin system (SpringCloudAlibaba, Dubbo3, Sa-Token, MyBatis-Plus), third-party social-login binding Affected Versions: v6.0.0, the official latest release, commit 27a79a19a19e1928aa33799d8b69c7284c8cf631. Earlier releases were not individually bisected. Classifications: CWE-639 Authorization Bypass Through User-Controlled Key (IDOR), CWE-862 Missing Authorization Status: Coordinated disclosure in progress through VulnCheck. No CVE assigned yet. Remediation Recommendation: Add permission checks and ownership validation to the unbind endpoint to ensure users can only unbind their own social login bindings. Code Example: Detailed Attack Steps 1. Login: Log in using any valid client and account via , and retain the returned token. Send the token as the header in subsequent calls. The gateway accepts tokens on all non-whitelisted paths. 2. Obtain Target Binding ID: is a Snowflake ID, so it cannot be sequentially enumerated starting from 1. A real attacker would derive candidates from side channels, such as previously unbound URLs logged in operation logs, values leaked in error exports, or Snowflake guesses narrowed to the time window when the victim's account was unbound. The vulnerability does not depend on how the ID is obtained. 3. Delete Victim Binding: Example, not executed: The gateway runs and forwards the request to . calls the Dubbo method , which executes . The matching row is removed.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-110107: RuoYi-Cloud-Plus IDOR in social-account unbind endpoint allows unauthorized account unbinding

More from this source