RuoYi CVE-2026-108800

Exploitation requires a victim with an active authenticated RuoYi session (an administrator or privileged user) to be lured into loading attacker-controlled content while logged in - this is the UI:P interaction prerequisite. The specific condition is that at least one state-changing endpoint (per the referenced report, a GET-based delete operation) lacks anti-CSRF token validation, allowing a cross-origin request to carry the victim's session cookie. Limiting factors: the attacker gains no direct access, cannot authenticate themselves (the victim's session is essential), impact is confined to actions the victim is authorized to perform, and success depends on the victim being logged in at the moment of interaction. If deployments enforce SameSite cookies or server-side CSRF tokens, exploitation is blocked.

This is a medium-severity cross-site request forgery (CWE-352) in RuoYi 4.8.3, rated CVSS 4.0 base 5.3 by VulDB. The provided 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N) is internally consistent with CSRF: network-reachable, low complexity, no attacker privileges, but requires passive victim interaction (UI:P) and yields only low integrity impact with no confidentiality or availability loss. The E:X (exploit maturity Not Defined) carries no exploitation signal. No EPSS score, no CISA KEV listing, and no SSVC decision data were supplied, and the input contains no explicit POC flag - so there is no corroborating evidence of real-world exploitation. One reference (github.com/Bob-wentao/security-report-for-ruoyi-csrf-get-delete) indicates a third-party security report describing a GET-based delete reachable via CSRF, which strengthens technical credibility but is not confirmed weaponized exploit code. Net assessment: this is a genuine but modest-priority issue - the low integrity-only impact, mandatory authenticated-victim interaction, and absence of any exploitation telemetry place it well below CVSS-critical network RCE concerns. It warrants routine patching rather than emergency response. Note the vendor was contacted but did not respond, so no official fix or affected-version confirmation exists.

An attacker crafts a malicious web page (or email link) containing an auto-submitting request to a RuoYi state-changing endpoint, such as a GET-based delete action. When an already-authenticated RuoYi administrator visits the page, their browser automatically sends the forged request with valid session cookies, causing an unintended action (e.g., record deletion) to execute under their identity. A third-party security report referencing a CSRF GET-delete issue exists, but no confirmed public exploit code was provided in the input.