CVE-2026-108800: RuoYi 4.8.3 CSRF Vulnerability

CVE-2026-108800 Overview

CVE-2026-108800 is a Cross-Site Request Forgery (CSRF) vulnerability affecting yangzongzhuan RuoYi version 4.8.3. RuoYi is a widely-used open-source Java-based rapid development framework for enterprise management systems. The flaw resides in an unspecified function that performs state-changing operations through HTTP GET requests, enabling attackers to trigger unauthorized deletions when an authenticated user visits a malicious page. The vendor was contacted prior to public disclosure but did not respond. The weakness is categorized under CWE-352: Cross-Site Request Forgery.

Critical Impact
Remote attackers can trigger unauthorized delete operations in RuoYi 4.8.3 by convincing an authenticated administrator to visit a crafted web page, with no additional privileges required.

Affected Products

yangzongzhuan RuoYi 4.8.3
Deployments relying on GET-based delete endpoints without CSRF tokens
Downstream forks and derivatives inheriting the vulnerable request handling

Discovery Timeline

2026-10-12 - CVE-2026-108800 published to the National Vulnerability Database (NVD)
2026-10-15 - Last updated in NVD database
2026-10-16 - EPSS score published at 0.211%

Technical Details for CVE-2026-108800

Vulnerability Analysis

The vulnerability stems from RuoYi exposing a sensitive delete operation over an HTTP GET request without validating a CSRF token or verifying the request origin. An attacker hosts a page containing an auto-loading resource, such as an <img> tag or iframe, that points to the vulnerable RuoYi endpoint. When a user with an active RuoYi session visits the attacker-controlled page, the browser automatically transmits the user's session cookie with the forged request. The server processes the delete action as if the authenticated user intended it.

User interaction is required, since the victim must load the malicious page while logged in. The impact is limited to integrity, as the vulnerable endpoint performs destructive operations rather than exposing confidential data. Public reporting via the GitHub Security Report demonstrates the attack against delete endpoints reachable through GET.

Root Cause

The root cause is a design flaw in how RuoYi handles state-changing operations. The affected delete function accepts GET requests and relies solely on session cookies for authorization. The application does not enforce a per-request anti-CSRF token, does not require SameSite cookie restrictions, and does not validate the Origin or Referer header. This directly violates the REST convention that GET requests must be safe and idempotent.

Attack Vector

Exploitation is network-based and requires no attacker authentication. The attacker crafts a page that references the vulnerable RuoYi URL. Delivery is typically through phishing, forum posts, or watering-hole content. Once an authenticated administrator loads the page, the forged GET request executes under their privileges, and the targeted record is removed. Additional technical context is available in the VulDB entry for CVE-2026-108800.

Detection Methods for CVE-2026-108800

Indicators of Compromise

Unexpected DELETE-equivalent operations in RuoYi audit logs correlated with an administrator's session.
HTTP GET requests to RuoYi delete endpoints with a Referer header pointing to an external, unrelated domain.
Session cookies issued to administrators appearing in requests originating from browser contexts that did not load the RuoYi UI.

Detection Strategies

Review application access logs for GET requests to administrative endpoints that perform record deletion or modification.
Alert on administrative state-changing requests whose Referer or Origin headers do not match the RuoYi application domain.
Correlate authenticated user sessions with sudden spikes in deletion events, particularly outside normal working hours.

Monitoring Recommendations

Forward RuoYi web server and application logs to a centralized analytics platform for continuous review.
Enable browser-based telemetry on administrator workstations to flag outbound requests to RuoYi triggered by untrusted pages.
Baseline the normal volume of delete operations and alert on statistical deviations.

How to Mitigate CVE-2026-108800

Immediate Actions Required

Restrict administrative access to RuoYi 4.8.3 to trusted networks or VPN segments until a patch is available.
Instruct administrators to log out of RuoYi when not actively using it and to avoid browsing untrusted sites during administrative sessions.
Audit recent delete and modification events in RuoYi for signs of unauthorized actions.

Patch Information

The vendor did not respond to the disclosure, and no official patch is referenced in the advisory at the time of publication. Monitor the RuoYi GitHub project for a security release and the VulDB vulnerability record 416577 for updates on remediation status.

Workarounds

Place RuoYi behind a reverse proxy or web application firewall configured to block state-changing GET requests to known delete endpoints.
Require the Origin or Referer header to match the application domain for sensitive endpoints and reject mismatched requests.
Set session cookies with the SameSite=Strict or SameSite=Lax attribute to prevent cross-site cookie transmission.
Rewrite destructive operations to require POST with a server-validated anti-CSRF token in forked or self-maintained builds.

bash

# Example Nginx rule rejecting cross-origin GETs to a RuoYi delete endpoint
location ~ ^/system/.*/remove/ {
    if ($request_method = GET) { return 405; }
    if ($http_origin !~* ^https://ruoyi\.example\.com$) { return 403; }
    proxy_pass http://ruoyi_backend;
}