# CVE-2026-88616: RuoYi-Vue-Plus authorization bypass in workflow task completion

Source: https://junglewise.ai/threats/cve-2026-88616-ruoyi-vue-plus-authorization-bypass-in-workflow-task-completion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-88616 · Severity: high · CVSS 8.8 · Published 2026-09-15

RuoYi-Vue-Plus is a multi-tenant administrative management system that handles workflow approval tasks. An authenticated user can bypass task-assignee restrictions by submitting specially crafted requests to the workflow completion endpoint, allowing them to approve or modify workflow tasks they are not authorized to handle. This undermines the integrity of business process controls and approval chains.

Technologies: [Dromara RuoYi-Vue-Plus](https://junglewise.ai/threats/technologies/ruoyi-vue-plus). Vendors: [Dromara](https://junglewise.ai/threats/vendors/dromara).

## Quick answers

**Is CVE-2026-88616 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88616 being exploited in the wild.

**How severe is CVE-2026-88616?** High severity, with a CVSS score of 8.8, published 15 September 2026.

**Which products and versions are affected?** Dromara RuoYi-Vue-Plus 6.0.0.

**Is there a fix for CVE-2026-88616?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-88616 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-88616?** Check whether you run Dromara RuoYi-Vue-Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an incorrect authorization flaw (CWE-863) in the FlwTaskServiceImpl.completeTask and CompleteExecuteComponent.process components. The FlwTaskController accepts workflow task completion requests that include client-controlled bypass flags (ignore, ignoreDepute, ignoreCooperate) which are directly copied into FlowParams without server-side validation. When these flags are set to true, the Warm-Flow TaskService.skip() method bypasses the normal task-assignee authorization check. An attacker with a low-privileged authenticated account and knowledge of a valid task ID can exploit this to circumvent approval restrictions. The fix requires implementing server-side authorization checks before workflow engine invocation and rejecting client-controlled bypass flags.

## Affected products

- dromara RuoYi-Vue-Plus 6.0.0

## Timeline

- 2026-09-15: disclosed
- 2026-09-15: advisory

## References

- [https://github.com/dromara/RuoYi-Vue-Plus](https://github.com/dromara/RuoYi-Vue-Plus)
- [https://github.com/returnwrong/returnwrong-security-advisories/blob/main/CVE-2026-88616.md](https://github.com/returnwrong/returnwrong-security-advisories/blob/main/CVE-2026-88616.md)

## Related threats

- [RuoYi-Vue-Plus authorization bypass in SysUserServiceImpl](https://junglewise.ai/threats/cve-2026-119647-ruoyi-vue-plus-through-6-0-0-contains-an-authorization-bypass)
- [RuoYi-Vue-Plus insecure direct object reference in social login](https://junglewise.ai/threats/cve-2026-110106-ruoyi-vue-plus-through-6-0-0-contains-an-insecure-direct-object)
- [Dromara RuoYi-Vue-Plus improper authorization in workflow controllers](https://junglewise.ai/threats/cve-2026-77795-dromara-ruoyi-vue-plus-improper-authorization-in-workflow)
- [dromara RuoYi-Vue-Plus missing authorization in FlwTaskController](https://junglewise.ai/threats/cve-2026-58176-dromara-ruoyi-vue-plus-missing-authorization-in-flwtaskcontroller)
- [The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface…](https://junglewise.ai/threats/cve-2025-66916-the-snailjob-component-in-ruoyi-vue-plus-versions-5-5-1-and)