CVE-2026-58176 Details
Description
RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management endpoints under /workflow/task (FlwTaskController) without any permission check: the controller declares no class-level or method-level authorization annotation, so the endpoints are gated only by global authentication. Any authenticated user, regardless of assigned role, can therefore reassign workflow approval tasks to arbitrary users via updateAssignee (defeating segregation of duties in the approval process), urge arbitrary tasks, and enumerate all pending and finished tasks via the pageByAllTaskWait and pageByAllTaskFinish listing endpoints. The issue was resolved by adding permission identifiers (SaCheckPermission) to these endpoints.
A vulnerability exists in RuoYi-Vue-Plus versions through 5.6.2, within the workflow task management endpoints located under '/workflow/task' in the FlwTaskController. These endpoints lack proper authorization checks, leaving them accessible to any authenticated user, regardless of their role. This oversight allows users to reassign workflow approval tasks to others, urge tasks, and view all pending and completed tasks through the respective listing endpoints. The vulnerability arises because the controller does not implement any class-level or method-level authorization, relying solely on global authentication. The issue has been addressed in version 5.6.2 by incorporating permission identifiers to the affected endpoints.
Users can update to RuoYi-Vue-Plus version 5.6.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 30, 2026CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dromara/RuoYi-Vue-Plus/issues/44 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/dromara/RuoYi-Vue-Plus/commit/88d03d970d4d1e96e4fb2dfefaf19f627e8673e9 | [email protected] | Source CodeVendor |
| https://github.com/dromara/RuoYi-Vue-Plus/issues/44 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/ruoyi-vue-plus-missing-authorization-on-workflow-task-management-endpoints | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Dromara RuoYi-Vue-Plus | <= 5.6.2 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jun 30, 2026 | New CVE Received | [email protected] |