RuoYi-Cloud-Plus versions up to 6.0.0 contain an insecure direct object reference (IDOR) flaw that allows an authenticated user to delete the social login bindings of any other user by sending a DELETE request to /auth/unlock/{socialId}. The deletion removes the corresponding row from the sys_social table, thereby invalidating the victim’s OAuth tokens and denying them future social login access. This breach permits an attacker to disrupt the victim’s ability to authenticate via social platforms, which can be considered an unauthorized data deletion or disruption of service.

The vendor is dromara, and the specific product is RuoYi-Cloud-Plus. All installations of RuoYi‑Cloud‑Plus up to and including version 6.0.0 are vulnerable. No additional version information was provided beyond the highest affected release.

The CVSS base score is 2.3, indicating a low severity impact, and the EPSS score is not available, suggesting no quantified likelihood of exploitation at present. The vulnerability does not appear in the CISA KEV catalog. Because the flaw requires an authenticated user context to reach the DELETE endpoint, the attack vector is likely local or intra‑application rather than remote. An attacker who has legitimate credentials can exploit the IDOR to delete other users’ social bindings, potentially causing denial of service for affected accounts, but the scope remains limited to the data of individual users rather than system or network compromise.