https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T06:39:12.386515+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-108112 CVE-2026-108112 — ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via Workflow Delete Endpoint 2026-10-12T06:39:12.401104+00:00

Affected: ageerle ruoyi-ai

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/{uuid}. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them because softDelete() skips the PrivilegeUtil.checkAndGetByUuid() ownership check, removing owners' workflows.