CVE-2026-108803 | y_project RuoYi up to 4.8.3 Disable API /system/config/add changeStatus session expiration

October 11, 2026 Yanac

A vulnerability identified as critical has been detected in y_project RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the component Disable API. The manipulation leads to session expiration.

This vulnerability is traded as CVE-2026-108803. It is possible to initiate the attack remotely. There is no exploit available.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More