EUVD-2026-98940
GHSA-qfpm-hv5j-w5q6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with any valid account
-
DeliveryEnumerate or guess victim socialId
-
ExploitSend DELETE /auth/unlock/{socialId}
-
Executionsys_social row deleted without ownership check
-
ImpactVictim OAuth binding removed, social login blocked
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a valid authenticated session on the RuoYi-Cloud-Plus application (CVSS PR:L), so it is not exploitable by anonymous/unauthenticated attackers. The attacker must also supply a target socialId that identifies the victim's sys_social record (CVSS AT:P); because socialId is a database primary key it is typically sequential and enumerable, so this is a weak limiting factor rather than a strong one. No special product configuration or non-default feature is needed - the vulnerable DELETE /auth/unlock/{socialId} endpoint is a core part of the social-login/unbind flow and lacks an ownership check in all versions through 6.0.0. No user interaction from the victim is required. |
| Impact | This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L) scores only 2.3: network-reachable but requires an authenticated account (PR:L), carries an attack requirement (AT:P, i.e. the attacker must know or enumerate the victim's socialId), and produces only low integrity and low availability impact with zero confidentiality impact. CWE-639 (authorization bypass via user-controlled key / IDOR) matches the description precisely. No EPSS score, no CISA KEV listing, and no explicit POC flag were provided, so there is no evidence of active or at-scale exploitation - appropriate for a bug whose worst outcome is unbinding another user's OAuth login. Note one taxonomy mismatch to verify: the input Tag labels this 'Authentication Bypass', but it is actually an authorization/IDOR flaw that requires a valid authenticated session (PR:L), so it does not bypass authentication. The practical risk ceiling is low-value nuisance/denial of a victim's social-login convenience, not account takeover or data theft. |
| Exploit ScenarioDerived | An authenticated low-privileged user of a RuoYi-Cloud-Plus deployment (≤6.0.0) notes that social-login unbind is keyed on a primary-key socialId with no ownership check. By iterating or guessing socialId values and issuing DELETE /auth/unlock/{socialId}, they remove other users' sys_social rows, stripping victims' stored OAuth tokens and preventing those users from logging in via their social provider. Public technical write-ups (hackmd, VulnCheck advisory) describe the single trivial request, though no packaged exploit tool was indicated in the input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
An insecure direct object reference in RuoYi-Cloud-Plus through 6.0.0 lets any authenticated user delete another user's social login binding by calling DELETE /auth/unlock/{socialId}, causing the victim's OAuth token row in sys_social to be removed and effectively blocking their social login. Exploitation requires a valid session on the application (CVSS PR:L) plus knowledge or enumeration of the victim's socialId primary key, so this is a low-severity, low-priority issue rather than a remote pre-auth compromise. No public exploit identified at time of analysis, and the flaw is not listed as confirmed actively exploited (CISA KEV); the assessed CVSS:3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, consistent with limited integrity and availability impact on a single user's binding.
RemediationAI
No vendor-released patch or fix version is identified in the available data at time of analysis, so remediation currently depends on code-level or deployment-level controls. The primary fix is to add an ownership check in the unbind path - in SysSocialServiceImpl (around lines 111-113) or the TokenController handler - verifying that the sys_social record's owning user id matches the authenticated principal before deletion, and ideally deriving socialId from the session rather than accepting it as a path variable; this preserves the legitimate unbind feature with no functional side effects. Until such a fix is released, operators can temporarily disable the social-unbind capability or block DELETE /auth/unlock/{socialId} at the API gateway or WAF, accepting that legitimate users will be unable to unlink social accounts through the UI; alternatively, route unbind requests through an endpoint that resolves the binding server-side. Additional compensating controls include restricting network exposure of the ruoyi-auth service to trusted clients, tightening session issuance, and alerting on DELETE /auth/unlock/{socialId} calls where the targeted socialId does not belong to the requesting session. Track the upstream repository (https://github.com/dromara/RuoYi-Cloud-Plus) and the referenced advisory (https://www.vulncheck.com/advisories/ruoyi-cloud-plus-through-6.0.0-idor-via-delete-auth-unlock-socialid) for a patched release and upgrade promptly once a fixed version greater than 6.0.0 is published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is CWE-639 (Authorization Bypass Through User-Controlled Key), implemented in the social-login unbind flow of RuoYi-Cloud-Plus, a Spring Cloud based Java rapid-development platform. The vulnerable path spans two upstream source files: TokenController.java (lines 149-153 in commit 27a79a1) exposes the DELETE /auth/unlock/{socialId} endpoint, and SysSocialServiceImpl.java (lines 111-113) performs the deletion against the sys_social table using the caller-supplied key as the primary-key lookup without verifying that the row's owning user matches the authenticated principal. Because socialId is a database primary key, values are typically sequential and therefore enumerable by an authenticated attacker, which weakens the CVSS AT:P (Attack Requirements: Present) mitigating factor. The deleted row holds the victim's linked OAuth/social identity and token association, so removal silently severs the third-party login path for that account; there is no confidentiality loss, only limited integrity and availability impact scoped to the victim's social binding (S:U in the assessed 3.1 vector). Note that the upstream tag 'Authentication Bypass' overstates the issue: the attacker must already hold a valid authenticated session, and no authentication control is circumvented.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Authenticated low-priv network attacker (PR:L, AV:N); socialId is an enumerable primary key so AC:L; deletes another user's binding (I:L) and blocks their login (A:L); no data disclosure (C:N).
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId}, which deletes sys_social rows by primary key without ownership checks, removing victims' OAuth tokens and blocking social login.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB