Auth bypass in Dromara Ruoyi-Vue-Plus
CVE-2026-58176
RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management endpoints under /workflow/task (FlwTaskController) without any permission check: the controller declares no class-level or method-level authorization annotation, so the endpoints are gated only by global authentication. Any authenticated user, regardless of assigned role, can therefore reassign workflow approval tasks to arbitrary users via updateAssignee (defeating segregation of duties in the approval process), urge arbitrary tasks, and enumerate all pending and finished tasks via the pageByAllTaskWait and pageByAllTaskFinish listing endpoints. The issue was resolved by adding permission identifiers (SaCheckPermission) to these endpoints.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.005 (37.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 38th percentile — 37.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Dromara Ruoyi-Vue-Plus — versions 0, 88d03d970d4d1e96e4fb2dfefaf19f627e8673e9
Weakness classification (CWE)
References
- github.com/dromara/RuoYi-Vue-Plus/issues/44 (technical-description, exploit)
- github.com/dromara/RuoYi-Vue-Plus/commit/88d03d970d4d1e96e4fb2dfefaf19f627e8673… (patch)
- www.vulncheck.com/advisories/ruoyi-vue-plus-missing-authorization-on-workflow-t… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-58176?
- CVE-2026-58176 is a medium-severity vulnerability in Dromara Ruoyi-Vue-Plus, classified under Missing Authorization. CVSS score: 6.5/10. Published 2026-06-30.
- How severe is CVE-2026-58176?
- Medium severity. CVSS v3 base score is 6.5 out of 10.