Description

A security vulnerability has been detected in y_project RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the component Disable API. The manipulation leads to session expiration. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-10-12T06:16:59.223Z",
  "pubdate": "2026-10-12T06:16:59.223Z",
  "executiveSummary": "A session expiration vulnerability has been identified in the y_project RuoYi framework, specifically affecting versions up to 4.8.3.\nThe vulnerability resides within the 'changeStatus' function located in the '/system/config/add' component, which is associated with the 'Disable API' functionality.\nThe flaw permits an unauthenticated or remote attacker to trigger an unauthorized session termination for active users.\nBy manipulating the request parameters targeting the vulnerable endpoint, an adversary can forcibly invalidate existing user sessions, leading to a denial-of-service condition regarding access to the application.\nThe primary risk implication involves the potential for system-wide service disruption and forced logout of administrative or standard user sessions.\nExploitation is possible remotely, requiring no complex interaction beyond sending a specifically crafted request to the identified path.\nAs the vendor has not provided a security patch or official response, organizations utilizing these versions remain exposed to potential service availability attacks.",
  "technicalDetails": "The vulnerability is localized within the 'changeStatus' function of the RuoYi application, specifically exposed via the '/system/config/add' URI path.\nRoot cause analysis indicates an improper validation of input parameters or inadequate access control checks within the 'Disable API' component logic, which handles configuration status updates.\nWhen a specially crafted request is sent to this endpoint, the application incorrectly executes a logic flow that triggers the destruction or premature expiration of active session tokens.\nAttack flow begins with an attacker identifying the endpoint '/system/config/add' as a reachable surface. By performing a remote request manipulation, the attacker influences the 'changeStatus' function to operate outside of its intended administrative scope.\nThe lack of sufficient server-side authentication checks allows the remote request to invoke backend configuration changes that result in the invalidation of the application session context.\nBecause the 'Disable API' functionality is improperly gated, the internal session management mechanism interprets the malicious request as a legitimate instruction to update status, which subsequently forces a session kill command or clears the session state in the underlying cache/persistence layer.\nImpact includes the immediate termination of legitimate user sessions, forcing re-authentication and effectively hindering ongoing administrative or operational tasks.\nThis vulnerability is classified as remotely exploitable, as it does not require prior knowledge of legitimate user credentials or established session tokens to initiate the destruction sequence.\nThe post-exploitation state is characterized by authenticated users being dropped to the login portal, creating a measurable impact on system availability and user experience.\nIn the context of the RuoYi architecture, the 'changeStatus' function serves as a critical configuration bridge, and its exposure via '/system/config/add' indicates a failure in authorization enforcement for administrative API operations."
}