https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 08:55:50 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-110107 <p>RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users&#39; social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId}, which deletes sys_social rows by primary key without ownership checks, removing victims&#39; OAuth tokens and blocking social login.</p> <p>RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users&#39; social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId}, which deletes sys_social rows by primary key without ownership checks, removing victims&#39; OAuth tokens and blocking social login.</p> https://db.gcve.eu/vuln/fkie_cve-2026-110107 https://db.gcve.eu/vuln/ghsa-qfpm-hv5j-w5q6 <p>RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users&#39; social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId}, which deletes sys_social rows by primary key without ownership checks, removing victims&#39; OAuth tokens and blocking social login.</p> <p>RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users&#39; social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId}, which deletes sys_social rows by primary key without ownership checks, removing victims&#39; OAuth tokens and blocking social login.</p> https://db.gcve.eu/vuln/ghsa-qfpm-hv5j-w5q6