EUVD-2026-95884
GHSA-rxv9-x3r4-pp2r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as non-admin tenant user
-
DeliverySend GET /workflow/search request
-
ExploitBypass missing owner/is_public filter
-
ExecutionEnumerate other users' private workflows
-
ImpactExfiltrate UUIDs and node/edge configurations
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated non-admin user account within the target tenant (PR:L) and a multi-tenant ruoyi-ai 3.0.0-3.1.0 deployment; the GET /workflow/search endpoint lacks owner and is_public filtering, so any such user can list workflows they do not own. Exposure is limited to workflows that are both enabled and private within the same tenant - disabled workflows and cross-tenant data are not returned, and anonymous/unauthenticated users cannot reach the endpoint, which bounds real-world impact to insider or compromised-credential scenarios. |
| Impact | This is a moderate, authorization-boundary issue rather than a high-urgency threat. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores 5.3 and is internally consistent with the description: network-reachable, low complexity, but requiring an authenticated low-privilege account (PR:L) and yielding only limited confidentiality impact (VC:L) with no integrity or availability effect. There is no EPSS score and no SSVC decision data in the input, so automatability and technical-impact framing cannot be derived. The vulnerability is NOT in CISA KEV, so under the precision rules this is 'no confirmed active exploitation'; however, publicly available exploit code exists (hackmd write-up tagged 'exploit' plus a VulnCheck advisory), which raises practical risk for internet-exposed multi-tenant deployments. The signals are consistent - there is no CVSS-versus-description conflict - but note a scope nuance: cross-user data exposure within one tenant is an authorization failure, not a confidentiality breach of high-value secrets, which is why impact is correctly rated Low rather than High. Net: a real but bounded information-disclosure bug; prioritize patching where ruoyi-ai is multi-tenant and internet-facing, but it does not warrant emergency, break-glass response absent KEV listing. |
| Exploit ScenarioDerived | A legitimate but non-admin user of a multi-tenant ruoyi-ai 3.0.0-3.1.0 deployment sends a GET request to /workflow/search and receives back other tenants users' enabled private workflows, including UUIDs and full node/edge configurations. Because the endpoint omits owner and is_public filtering, the attacker harvests competitors' or colleagues' proprietary workflow logic without triggering any authorization error. A public write-up and VulnCheck advisory with working reproduction steps already exist, lowering the barrier to exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Authenticated non-admin users of ruoyi-ai 3.0.0 through 3.1.0 can enumerate other users' enabled private workflows through the GET /workflow/search endpoint, which performs no owner or is_public filtering and returns workflow UUIDs together with full node and edge definitions. The exposure is confined to the caller's own tenant and to workflows that are both enabled and private, so disabled items and cross-tenant data remain hidden, but any holder of a low-privileged account can harvest sensitive automation logic belonging to colleagues. Proof-of-concept code is publicly available (a HackMD write-up linked from the CVE record), no confirmed in-the-wild exploitation or CISA KEV listing has been reported, and the CVSS 4.0 base score is 5.3 (CVSS:3.1 equivalent AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting a confidentiality-only, authorization-boundary defect rather than data tampering or service disruption.
RemediationAI
No vendor-released patch for CVE-2026-108111 is identified in the available references, which point only to vulnerable v3.1.0 source rather than a fixed release, so treat the upstream GitHub repository (https://github.com/ageerle/ruoyi-ai) and the VulnCheck advisory (https://www.vulncheck.com/advisories/ruoyi-ai-3.0.0-through-3.1.0-missing-authorization-via-workflow-search) as the tracking sources and apply an upstream fix as soon as one is published. Until then, the most direct compensating control is to add owner/is_public predicates to the WorkflowService query or a @PreAuthorize-style object-level check in WorkflowController so that GET /workflow/search returns only workflows the caller owns or that are explicitly public - note this changes listing semantics for admin tooling and must be regression-tested. If code changes are not feasible, disable or firewall the /workflow/search route at the reverse proxy or gateway for non-admin roles (return 403/404), accepting that legitimate workflow-search functionality is lost; alternatively restrict the endpoint to an administrative role, which reduces but does not eliminate insider exposure and may break user-facing workflow UIs. Supplementary measures with their own trade-offs include aggressively lowering session lifetime and enforcing MFA for all accounts so a compromised low-privileged credential has a narrower window, and auditing access logs for anomalous /workflow/search calls by non-admin principals to detect enumeration. Rotating or revoking any workflow secrets embedded in node/edge configurations that may already have been harvested is advisable, since the endpoint discloses full configuration contents.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ruoyi-ai is a Java/Spring Boot AI workflow platform built on the RuoYi framework, with its flow-orchestration logic in the ruoyi-modules/ruoyi-aiflow module. The vulnerability is a textbook CWE-862 Missing Authorization: the service method behind GET /workflow/search (WorkflowService.java, lines ~187-202 in tag v3.1.0) builds its query without an owner or is_public predicate, and the corresponding controller handler (WorkflowController.java, lines ~121-130) enforces only a generic authenticated/session check rather than an object-level authorization decision. Because the service is also tenant-aware only for isolation between tenants, not between users inside a tenant, an ordinary non-admin account can request the full list of enabled private workflows and receive their UUIDs along with serialized node and edge configuration - effectively the complete orchestration logic of another user's automation. The CPE cpe:2.3:a:ageerle:ruoyi-ai:*:*:*:*:*:*:*:* identifies the ageerle/ruoyi-ai distribution as the affected upstream, and the vulnerable range in the record spans 3.0.0 through 3.1.0. This is an object-level access control failure (IDOR-style listing) rather than an authentication bypass: the endpoint cannot be reached anonymously, and the CVE's 'Authentication Bypass' tag overstates the weakness relative to the assessed vector, which requires a valid, low-privileged (PR:L) session.
Know when Ruoyi Ai gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network endpoint reachable by any authenticated low-privilege tenant user (PR:L), no user interaction, same security scope, with only limited confidentiality disclosure and no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticated non-admin users can query this endpoint, which lacks owner or is_public filtering, to list enabled private workflows in the same tenant, including UUIDs and full node and edge configurations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
A vulnerability was found in ageerle ruoyi-ai up to 2.0.1 and classified as critical. Rated medium severity (CVSS 6.9),
A vulnerability classified as critical has been found in ageerle ruoyi-ai up to 2.0.0. Rated medium severity (CVSS 6.9),
Authenticated users of ruoyi-ai 3.0.0 through 3.1.0 can delete workflows owned by other accounts by issuing POST /workfl
Unrestricted file upload in ruoyi-ai 2.0.0 allows remote authenticated attackers to upload arbitrary files via the speec
Exploit-DB