Executive brief
RuoYi-Vue-Plus is a multi-tenant administrative management system that handles workflow approval tasks. An authenticated user can bypass task-assignee restrictions by submitting specially crafted requests to the workflow completion endpoint, allowing them to approve or modify workflow tasks they are not authorized to handle. This undermines the integrity of business process controls and approval chains.
Technical details
The vulnerability is an incorrect authorization flaw (CWE-863) in the FlwTaskServiceImpl.completeTask and CompleteExecuteComponent.process components. The FlwTaskController accepts workflow task completion requests that include client-controlled bypass flags (ignore, ignoreDepute, ignoreCooperate) which are directly copied into FlowParams without server-side validation. When these flags are set to true, the Warm-Flow TaskService.skip() method bypasses the normal task-assignee authorization check. An attacker with a low-privileged authenticated account and knowledge of a valid task ID can exploit this to circumvent approval restrictions. The fix requires implementing server-side authorization checks before workflow engine invocation and rejecting client-controlled bypass flags.
Affected products
- dromara RuoYi-Vue-Plus 6.0.0
Timeline
- 2026-09-15: disclosed
- 2026-09-15: advisory