https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T22:02:46.127033+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-108111 CVE-2026-108111 — ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via /workflow/search 2026-10-10T22:02:46.146844+00:00

Affected: ageerle ruoyi-ai

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticated non-admin users can query this endpoint, which lacks owner or is_public filtering, to list enabled private workflows in the same tenant, including UUIDs and full node and edge configurations.