CVE-2026-58176: RuoYi-Vue-Plus Workflow Task Authorization Bypass

Technical summary

The FlwTaskController component in RuoYi-Vue-Plus exposes multiple workflow task endpoints under the /workflow/task path without implementing method-level or class-level authorization checks. While the application does require users to be authenticated (logged in), it does not verify that the authenticated user has permission to execute specific workflow actions. Affected endpoints include updateAssignee (task reassignment), urge (task escalation), pageByAllTaskWait (enumeration of pending tasks), and pageByAllTaskFinish (enumeration of completed tasks). The vulnerability stems from the absence of @SaCheckPermission annotations that would ordinarily enforce role-based access control. An authenticated attacker with any active session can invoke these endpoints directly via HTTP requests. The fix, implemented in commit 88d03d9, adds permission identifiers to gate access based on assigned privileges.

Business impact

Workflow approval processes form the backbone of financial controls, HR approvals, and change management in most organizations. When any authenticated user can reassign approval tasks, the resulting risks include: (1) Fraud—an employee could approve their own leave requests, purchase orders, or exceptions; (2) Compliance violations—audit trails become unreliable if task ownership can be falsified; (3) Operational chaos—attackers can disrupt legitimate approvals by reassigning critical tasks, delaying business operations. In regulated industries (finance, healthcare, manufacturing), this directly violates segregation of duties requirements and exposes the organization to audit failures and regulatory sanctions.

Affected systems

RuoYi-Vue-Plus versions 5.6.2 and earlier are affected. The vulnerability is present in the workflow task controller and does not require any special configuration to expose—it is a code-level defect in the authorization layer. Organizations using RuoYi-Vue-Plus for workflow automation, particularly those running versions released before late June 2026, should prioritize inventory and patching. The vulnerable component is part of the core application framework, so all deployments with /workflow/task endpoints enabled are at risk.

Exploitability

Exploitation requires valid login credentials and access to the application. An attacker needs only a standard user account—no administrative privileges or special roles are necessary. The endpoints are accessible over the network via HTTP/HTTPS and require no user interaction. An attacker with a low-privilege account could immediately begin reassigning tasks, enumerating workflow state, and disrupting approvals. The simplicity of the attack (basic HTTP requests to documented endpoints) combined with the common deployment of workflow systems makes this vulnerability moderately easy to exploit once an attacker gains initial access or possesses valid credentials. No public exploit code needs to be released for attackers to weaponize this; the flaw is straightforward to discover through basic endpoint enumeration.

Remediation

The primary remediation is to upgrade RuoYi-Vue-Plus to a patched version (verify availability from the vendor) or apply the fix present in commit 88d03d9 or later. The patch adds @SaCheckPermission annotations to the FlwTaskController methods, enforcing role-based authorization checks. Organizations unable to patch immediately should implement compensating controls: (1) restrict network access to the /workflow/task endpoints to trusted IP ranges or VPN; (2) implement endpoint-level monitoring to alert on unusual task reassignment patterns; (3) audit all workflow task changes and cross-reference against expected user behavior; (4) consider disabling or blocking direct API access to these endpoints if not required for your workflow design.

Patch guidance

Contact the RuoYi-Vue-Plus project or check the official repository for patch availability. Verify that your patched version includes the authorization annotations in FlwTaskController. Before deploying patches to production, test that legitimate workflow approvers can still perform their assigned tasks and that non-approvers are properly denied access. Review access logs after patching to identify any historical unauthorized task reassignments and remediate those records. If you maintain a fork or custom build of RuoYi-Vue-Plus, backport the fix from commit 88d03d9 to your codebase.

Detection guidance

Look for HTTP requests to /workflow/task/updateAssignee, /workflow/task/urge, /workflow/task/pageByAllTaskWait, or /workflow/task/pageByAllTaskFinish from user accounts with low privilege levels or from users not typically involved in approval workflows. Correlate these requests with user role assignments and task ownership records. A spike in task reassignments, especially to the same user across multiple workflows, is a strong indicator of exploitation. Enable application logging at the controller level to capture all workflow task API calls with user context and timestamp. Audit approval workflows where the assigner and final approver are the same person—this is a signature of post-exploitation abuse. Search historical logs for any /workflow/task endpoint requests before the patch was deployed.

Why prioritize this

This is a medium-severity authorization flaw affecting core business process controls. Although the CVSS score is 6.5 (MEDIUM), the business impact is high because workflow integrity directly affects financial and operational controls. Exploitation does not require sophisticated techniques or zero-day knowledge; it is practical and repeatable by anyone with valid credentials. The vulnerability has not been added to the CISA KEV catalog, suggesting either limited known public exploitation or slow adoption of this particular framework, but security teams should not rely on KEV status as a sole prioritization signal. Prioritize this based on whether your organization relies on RuoYi-Vue-Plus for approval workflows, the sensitivity of the approvals, and your current patch cycle velocity.

Risk score, explained

CVSS 6.5 reflects a network-accessible, low-complexity attack requiring prior authentication, with high impact on integrity (the attacker can modify task assignments and workflow state) but no direct loss of confidentiality or availability. The score appropriately captures the technical severity of unauthorized workflow manipulation. However, from a business risk perspective, organizations in regulated industries or those with high-value approval workflows should treat this as a priority-one issue because integrity of approvals is a foundational control. The absence of CVSS confidentiality impact (C:N) understates real-world risk if attackers use task reassignment to gain visibility into sensitive approvals; recommend internal risk scoring that factors in your workflow sensitivity and audit requirements.

Frequently asked questions