CVE-2026-108111

Name of the Vulnerable Software and Affected Versions ruoyi-ai versions 3.0.0 through 3.1.0

Description An authorization flaw exists in the 'GET /workflow/search' endpoint. Authenticated users without administrative privileges can query this endpoint to list enabled private workflows within the same tenant. This occurs because the endpoint fails to implement filtering based on the owner or the is public status, leading to the exposure of private workflow UUIDs and complete node and edge configurations.

Recommendations Update ruoyi-ai versions 3.0.0 through 3.1.0 to a version where this issue is resolved. Restrict access to the 'GET /workflow/search' endpoint to prevent unauthorized access to private workflows.