Vulnerabilidades do Ageerle Ruoyi-ai
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Ageerle Ruoyi-ai: 2 registro(s), com versões afetadas e correções.
CVE-2026-108112
Média · 5.4
CWE-862 09/10/2026
ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via Workflow Delete Endpoint
ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/{uuid}. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them because softDelete() skips the PrivilegeUtil.checkAndGetByUuid() ownership check, removing owners' workflows.
CVE-2026-108111
Média · 4.3
CWE-862 09/10/2026
ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via /workflow/search
ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticated non-admin users can query this endpoint, which lacks owner or is_public filtering, to list enabled private workflows in the same tenant, including UUIDs and full node and edge configurations.