CVE-2026-108803

Published: Oct 12, 2026Modified: Oct 13, 2026Deferred

5.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: CNA (Secondary)

Description

A security vulnerability has been detected in y_project RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the component Disable API. The manipulation leads to session expiration. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Related CWEs

CWE-613

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (5)

https://github.com/Bob-wentao/security-report-for-ruoyi-csrf-get-delete/blob/main/security-report-ruoyi-4.8.3-insufficient-session-expiration.md

Source: cna@vuldb.com

https://vuldb.com/cve/CVE-2026-108803

Source: cna@vuldb.com

https://vuldb.com/submit/962567

Source: cna@vuldb.com

https://vuldb.com/vuln/416580

Source: cna@vuldb.com

https://vuldb.com/vuln/416580/cti

Source: cna@vuldb.com

Timeline

No history available yet.