CVE-2026-110118 Details
Description
WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the complete, completeTask or reAssign handlers to approve tasks or reassign them without authority.
A missing authorization vulnerability has been identified in WorkFlow-Engine versions through 9.6.11. This vulnerability allows authenticated users to manipulate workflow tasks belonging to other users via the '/vue/buttonOperation' endpoints. Low-privileged attackers can exploit this by providing a known task ID to the 'complete', 'completeTask', or 'reAssign' handlers, thereby approving tasks or reassigning them without proper authorization.
To address this vulnerability, it is recommended to implement proper authorization checks on the task operation endpoints to ensure that only authorized users can manipulate tasks. This can be done by verifying that the user is the task assignee or has the appropriate permissions before allowing any task modifications.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| risesoft-y9 WorkFlow-Engine | <= 9.6.11 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |