CVE-2026-58176 describes a missing authorization vulnerability in dromara's RuoYi-Vue-Plus product through version 5.6.2. The workflow task management controller (FlwTaskController) exposes endpoints without specific permission checks, relying solely on global authentication. This allows any authenticated user, regardless of role, to perform unauthorized actions such as reassigning approval tasks, urging tasks, and listing all tasks. The vulnerability undermines segregation of duties in the approval process. The fix was implemented by adding SaCheckPermission annotations to enforce proper authorization on these endpoints.

The vulnerability allows any authenticated user to reassign workflow approval tasks to arbitrary users, urge arbitrary tasks, and enumerate all pending and finished tasks. This defeats segregation of duties controls in the workflow approval process, potentially enabling unauthorized task manipulation and information disclosure. There is no impact on confidentiality, but integrity is affected due to unauthorized task reassignment. Availability is not impacted.

A fix is available and was implemented by adding permission identifiers (SaCheckPermission) to the affected endpoints. Users should upgrade to a version later than 5.6.2 where this fix is applied. Since no official remediation level or patch link is provided, verify the fix by checking the vendor's repository or advisory for commit 88d03d9 or later versions. Until patched, restrict access to the workflow task endpoints to trusted users only.