CVE-2026-58448 is a broken access control vulnerability in yudao-cloud's BPM module affecting versions before 2026.06. The issue stems from an unprotected GET endpoint that lacks the @PreAuthorize annotation, allowing any authenticated user to query arbitrary process-instance identifiers. This leads to unauthorized access to sensitive workflow data including submitted form variables, approver identities, approval and rejection comments, and process BPMN XML. The vulnerability does not require elevated privileges beyond authentication and does not impact integrity or availability, but it compromises confidentiality.

An attacker with valid authentication can access sensitive process instance data without proper authorization. This includes confidential workflow details such as form inputs, identities of approvers, comments on approvals or rejections, and the BPMN XML defining the process. There is no impact on data integrity or system availability. The confidentiality breach could expose sensitive business process information to unauthorized users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the BPM module endpoints to trusted users only and consider implementing additional access control mechanisms or monitoring for suspicious access patterns. Avoid exposing process-instance identifiers to untrusted users. Follow vendor updates closely for an official fix or temporary mitigation.