CVE-2026-108803

6.3 MEDIUMpublic exploit available

Published 2026-10-12 · Updated 2026-10-13

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

A security vulnerability has been detected in y_project RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the component Disable API. The manipulation leads to session expiration. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weaknesses

CWE-613

Public exploit & PoC references

https://github.com/Bob-wentao/security-report-for-ruoyi-csrf-get-delete/blob/main/security-report-ruoyi-4.8.3-insufficient-session-expiration.md

All references

https://github.com/Bob-wentao/security-report-for-ruoyi-csrf-get-delete/blob/main/security-report-ruoyi-4.8.3-insufficient-session-expiration.md
https://vuldb.com/cve/CVE-2026-108803
https://vuldb.com/submit/962567
https://vuldb.com/vuln/416580
https://vuldb.com/vuln/416580/cti

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2024-8122
MEDIUMCVE-2025-71435PoC
MEDIUMCVE-2026-100502PoC
MEDIUMCVE-2026-100554PoC
MEDIUMCVE-2026-100624PoC
HIGHCVE-2026-100711PoC
UNSCOREDCVE-2026-101271
MEDIUMCVE-2026-102367PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.