Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-58176: RuoYi-Vue-Plus workflow task management endpoints are exposed to all users

CVE-2026-58176 · published 4 months ago

Summary

RuoYi-Vue-Plus, a business management platform, has a security issue where any authenticated user can manage workflow tasks without permission. This means users can reassign tasks, urge other users, and view all tasks, which can defeat the purpose of controlling who can approve or reject tasks. The developers have fixed this issue, so it's recommended to update to the latest version to stay secure.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
dromara	ruoyi-vue-plus	<= 5.6.2

Original advisory text

RuoYi-Vue-Plus - Missing Authorization on Workflow Task Management Endpoints

RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management endpoints under /workflow/task (FlwTaskController) without any permission check: the controller declares no class-level or method-level authorization annotation, so the endpoints are gated only by global authentication. Any authenticated user, regardless of assigned role, can therefore reassign workflow approval tasks to arbitrary users via updateAssignee (defeating segregation of duties in the approval process), urge arbitrary tasks, and enumerate all pending and finished tasks via the pageByAllTaskWait and pageByAllTaskFinish listing endpoints. The issue was resolved by adding permission identifiers (SaCheckPermission) to these endpoints.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58176... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-58176 Vendor Advisory
https://github.com/dromara/RuoYi-Vue-Plus Product
https://github.com/dromara/RuoYi-Vue-Plus/issues/44 Exploit
https://www.vulncheck.com/advisories/ruoyi-vue-plus-missing-authorization-on-wor... Vendor Advisory
https://github.com/dromara/RuoYi-Vue-Plus/commit/88d03d970d4d1e96e4fb2dfefaf19f6... Patch

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-862Missing Authorization

Timeline

Published30 Jun 2026

Updated4 Nov 2026

First seen30 Jun 2026

Sources

CVE-2026-58176 · NVD

CVE-2026-58176 · MITRE

CVE-2026-58176 · OSV

Track software like this

Free during beta