CVE-2026-58176: Missing Authorization in dromara RuoYi-Vue-Plus
RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management endpoints under /workflow/task (FlwTaskController) without any permission check: the controller declares no class-level or method-level authorization annotation, so the endpoints are gated only by global authentication. Any authenticated user, regardless of assigned role, can therefore reassign workflow approval tasks to arbitrary users via updateAssignee (defeating segregation of duties in the approval process), urge arbitrary tasks, and enumerate all pending and finished tasks via the pageByAllTaskWait and pageByAllTaskFinish listing endpoints. The issue was resolved by adding permission identifiers (SaCheckPermission) to these endpoints.
AI Analysis
Technical Summary
CVE-2026-58176 is a missing authorization vulnerability in dromara's RuoYi-Vue-Plus product affecting versions up to 5.6.2. The workflow task management controller (FlwTaskController) exposes endpoints without any specific permission checks, relying only on global authentication. This allows any authenticated user to perform unauthorized actions such as reassigning approval tasks to arbitrary users, urging tasks, and listing all pending and finished tasks. The vulnerability compromises the segregation of duties in workflow approvals. The issue was resolved by adding SaCheckPermission annotations to enforce proper authorization on these endpoints.
Potential Impact
The vulnerability allows any authenticated user to bypass role-based restrictions and manipulate workflow approval tasks, including reassigning tasks to arbitrary users and enumerating all tasks. This undermines the integrity of the approval process by defeating segregation of duties, potentially enabling unauthorized task approvals or workflow manipulation. There is no direct confidentiality or availability impact reported.
Mitigation Recommendations
A fix is available and was implemented by adding permission checks (SaCheckPermission) to the affected endpoints. Users should upgrade to a version later than 5.6.2 where this commit is included. Since no official patch version is explicitly stated, check the vendor repository or advisory for the exact fixed version or commit. Until patched, restrict access to the workflow task endpoints to trusted users only.
CVE-2026-58176: Missing Authorization in dromara RuoYi-Vue-Plus
Description
RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management endpoints under /workflow/task (FlwTaskController) without any permission check: the controller declares no class-level or method-level authorization annotation, so the endpoints are gated only by global authentication. Any authenticated user, regardless of assigned role, can therefore reassign workflow approval tasks to arbitrary users via updateAssignee (defeating segregation of duties in the approval process), urge arbitrary tasks, and enumerate all pending and finished tasks via the pageByAllTaskWait and pageByAllTaskFinish listing endpoints. The issue was resolved by adding permission identifiers (SaCheckPermission) to these endpoints.
CVSS v3.1
Score 6.5medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-58176 is a missing authorization vulnerability in dromara's RuoYi-Vue-Plus product affecting versions up to 5.6.2. The workflow task management controller (FlwTaskController) exposes endpoints without any specific permission checks, relying only on global authentication. This allows any authenticated user to perform unauthorized actions such as reassigning approval tasks to arbitrary users, urging tasks, and listing all pending and finished tasks. The vulnerability compromises the segregation of duties in workflow approvals. The issue was resolved by adding SaCheckPermission annotations to enforce proper authorization on these endpoints.
Potential Impact
The vulnerability allows any authenticated user to bypass role-based restrictions and manipulate workflow approval tasks, including reassigning tasks to arbitrary users and enumerating all tasks. This undermines the integrity of the approval process by defeating segregation of duties, potentially enabling unauthorized task approvals or workflow manipulation. There is no direct confidentiality or availability impact reported.
Mitigation Recommendations
A fix is available and was implemented by adding permission checks (SaCheckPermission) to the affected endpoints. Users should upgrade to a version later than 5.6.2 where this commit is included. Since no official patch version is explicitly stated, check the vendor repository or advisory for the exact fixed version or commit. Until patched, restrict access to the workflow task endpoints to trusted users only.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-06-29T16:23:52.713Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a43f43127e9c79719185f92
Added to database: 06/30/2026, 16:52:01 UTC
Last enriched: 07/16/2026, 09:19:48 UTC
Last updated: 08/13/2026, 00:41:13 UTC
Views: 78
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.