RuoYi CVE-2026-108803

Exploitation requires an existing authenticated low-privileged session on the RuoYi application (CVSS PR:L), targeting the Disable API 'changeStatus' handling tied to /system/config/add. The limiting condition is the CWE-613 insufficient session expiration behavior: an attacker must be able to reuse or retain a session token that the server should have invalidated, so the practical prerequisite is access to a valid-but-stale session rather than any special product configuration. This is not unauthenticated or default-config-exploitable: it depends on prior credential/session access, which meaningfully narrows the realistic attacker set to insiders, credential-reuse scenarios, or follow-on activity after another compromise.

This is a low-to-moderate priority issue that does not rise to an urgent threat despite being remotely reachable. The only severity signal present is a vendor/VulDB CVSS 4.0 score of 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:N and low impact across VC/VI/VA; no EPSS score, no CISA KEV listing, and no confirmed public exploit code are provided in the input. The CVSS vector requires PR:L, meaning the attacker must already hold a valid low-privileged authenticated session, which substantially limits real-world risk - this is a post-authentication weakness, not an unauthenticated internet-facing break-in. The underlying weakness is CWE-613 (Insufficient Session Expiration), which is consistent with the 'session expiration' description and the low technical impact, rather than code execution or data exfiltration. Note a signal conflict: the input Tags label this 'Information Disclosure', but CWE-613 is a session-management flaw, not a disclosure primitive, so the tag overstates the nature of the issue. The disclosure originates from a single source (VulDB) with the vendor explicitly non-responsive, so affected-version precision and impact details are not independently vendor-confirmed. Overall this reads as a genuine but low-urgency hardening issue rather than a widespread-exploitation emergency.

An attacker who already possesses a low-privileged RuoYi account (for example a session captured earlier or a shared/stale credential) reuses a session token that the application fails to properly expire, retaining authenticated access to the config 'changeStatus'/Disable API functionality beyond the intended session lifetime. Because the CVSS vector is AV:N/PR:L, this is performed remotely over the network but still requires that prior low-privileged authentication. A detailed third-party security write-up exists on GitHub, but no weaponized public exploit code is identified in the provided data.