Executive brief
RuoYi-Cloud-Plus is a microservice management system that includes a workflow module for task management. The workflow task APIs lack proper authorization checks, allowing any authenticated user to read task details they shouldn't access, trigger unauthorized workflow executions, and manipulate tasks regardless of their assigned role or permissions. This is a horizontal privilege escalation vulnerability that can expose sensitive process information and disrupt business workflows.
Technical details
The vulnerability is a horizontal privilege escalation / insecure direct object reference (IDOR) in the FlwTaskController of the ruoyi-workflow module. Multiple core task APIs (`/task/startWorkFlow`, `/task/completeTask`, `/task/terminationTask`, `/task/backProcess`, `/task/taskOperation/{op}`, `/task/getTask/{taskId}`, `/task/getNextNodeList`, `/task/currentTaskAllUser/{taskId}`) lack `@SaCheckPermission` annotations and the Service layer does not verify whether the current authenticated user is the task handler or has permission to operate the task. The attack vector is network-based and requires valid authentication (any low-privileged user token). An attacker can read arbitrary task details via IDOR, retrieve pending/completed task lists, start unauthorized workflows, and call write operations on tasks they do not own. Patches are available in versions later than 2.6.2.
Affected products
- Dromara RuoYi-Cloud-Plus <= 2.6.2
Timeline
- 2026-09-09: disclosed
- other: CVE assigned as CVE-2026-71807