Medium severity6.3NVD Advisory· Published Oct 12, 2026· Updated Oct 12, 2026

CVE-2026-108803

Description

A security vulnerability has been detected in y_project RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the component Disable API. The manipulation leads to session expiration. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

y_project/Ruoyillm-fuzzy
Range: <=4.8.3

Patches

Vulnerability mechanics

References

github.com/Bob-wentao/security-report-for-ruoyi-csrf-get-delete/blob/main/security-report-ruoyi-4.8.3-insufficient-session-expiration.mdnvd
vuldb.com/cve/CVE-2026-108803nvd
vuldb.com/submit/962567nvd
vuldb.com/vuln/416580nvd
vuldb.com/vuln/416580/ctinvd

News mentions

No linked articles in our index yet.

cvss	0.410
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000