This vulnerability affects Dromara RuoYi-Vue-Plus versions 5.6.0, 5.6.1, and 5.6.2. The flaw is in the Workflow Endpoint component, specifically in the listed controller functions, where improper authorization checks allow remote attackers to bypass intended access restrictions. The CVSS 4.0 base score is 5.3 (medium), indicating a network attack vector with low complexity and no user interaction required, but limited impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

An attacker can remotely exploit this vulnerability to bypass authorization controls in the affected Workflow Endpoint functions, potentially gaining unauthorized access or performing unauthorized actions within the application. The impact is limited to the scope of these functions and is rated medium severity based on CVSS 4.0 scoring.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected endpoints and monitor for suspicious activity related to these Workflow Endpoint functions.