Is CVE-2026-58176 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58176 being exploited in the wild.

How severe is CVE-2026-58176?

Medium severity, with a CVSS score of 6.5, published 30 June 2026.

Which products and versions are affected?

Dromara RuoYi-Vue-Plus through 5.6.2.

Is there a fix for CVE-2026-58176?

A patch was published on 2026-06-22: Fix committed in 88d03d970d4d1e96e4fb2dfefaf19f627e8673e9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-58176 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-58176?

Check whether you run Dromara RuoYi-Vue-Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58176: dromara RuoYi-Vue-Plus missing authorization in FlwTaskController

CVE-2026-58176 · Severity: medium · CVSS 6.5 · Published 2026-06-30

RuoYi-Vue-Plus is a management framework used to build business applications with integrated workflow capabilities. A security flaw allows any logged-in user to access and modify workflow tasks that they should not be able to see or control. This means a regular user could reassign approval tasks to themselves or others, effectively bypassing corporate oversight and the separation of duties required for sensitive business processes.

Technologies: Dromara RuoYi-Vue-Plus. Vendors: Dromara.

Quick answers

Is CVE-2026-58176 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58176 being exploited in the wild.
How severe is CVE-2026-58176?: Medium severity, with a CVSS score of 6.5, published 30 June 2026.
Which products and versions are affected?: Dromara RuoYi-Vue-Plus through 5.6.2.
Is there a fix for CVE-2026-58176?: A patch was published on 2026-06-22: Fix committed in 88d03d970d4d1e96e4fb2dfefaf19f627e8673e9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58176 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-58176?: Check whether you run Dromara RuoYi-Vue-Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization vulnerability (CWE-862) exists in the FlwTaskController of RuoYi-Vue-Plus through version 5.6.2. The controller lacks class-level or method-level authorization annotations (such as SaCheckPermission), meaning endpoints under /workflow/task are only protected by global authentication. An attacker with any valid user account can call updateAssignee to reassign workflow tasks, or use pageByAllTaskWait and pageByAllTaskFinish to enumerate all pending and completed tasks. This allows for the bypass of segregation of duties and unauthorized access to workflow metadata. The issue is fixed in commit 88d03d9 by implementing explicit permission checks.

Affected products

dromara RuoYi-Vue-Plus through 5.6.2

Timeline

2026-06-22: patched: Fix committed in 88d03d970d4d1e96e4fb2dfefaf19f627e8673e9
2026-06-30: advisory: NVD and VulnCheck advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.