Description
ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/{uuid}. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them because softDelete() skips the PrivilegeUtil.checkAndGetByUuid() ownership check, removing owners' workflows.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ageerle | ruoyi-ai | 3.0.0 – ≤ 3.1.0 | — |
References
- RuoYi AI exposes private workflow definitions and permits cross user soft deletion technical-description exploit
- WorkflowService.softDelete() at v3.1.0 technical-description
- WorkflowController /workflow/del/{uuid} at v3.1.0 technical-description
- https://github.com/ageerle/ruoyi-ai product
- VulnCheck Advisory: ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via Workflow Delete Endpoint third-party-advisory