Executive brief
RuoYi-Vue-Plus is a management framework used to build business applications with integrated workflow capabilities. A security flaw allows any logged-in user to access and modify workflow tasks that they should not be able to see or control. This means a regular user could reassign approval tasks to themselves or others, effectively bypassing corporate oversight and the separation of duties required for sensitive business processes.
Technical details
A missing authorization vulnerability (CWE-862) exists in the FlwTaskController of RuoYi-Vue-Plus through version 5.6.2. The controller lacks class-level or method-level authorization annotations (such as SaCheckPermission), meaning endpoints under /workflow/task are only protected by global authentication. An attacker with any valid user account can call updateAssignee to reassign workflow tasks, or use pageByAllTaskWait and pageByAllTaskFinish to enumerate all pending and completed tasks. This allows for the bypass of segregation of duties and unauthorized access to workflow metadata. The issue is fixed in commit 88d03d9 by implementing explicit permission checks.
Affected products
- dromara RuoYi-Vue-Plus through 5.6.2
Timeline
- 2026-06-22: patched: Fix committed in 88d03d970d4d1e96e4fb2dfefaf19f627e8673e9
- 2026-06-30: advisory: NVD and VulnCheck advisory published