Which versions of yudao-cloud are affected by CVE-2026-58448?

yudao-cloud BPM deployments are vulnerable to unauthorized access of sensitive workflow data due to missing authorization controls.. A patch is available.

Is there a public PoC exploit available for CVE-2026-58448?

Yes, a public proof-of-concept exploit is available for CVE-2026-58448. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-58448?

Within 24 hours: confirm yudao-cloud BPM deployment status and current version in your environment. Within 7 days: apply vendor patch by upgrading to version 2026.06 or later in a test environment and validate process functionality. Within 30 days: deploy patched version to production and review access logs for evidence of prior unauthorized disclosure.

yudao-cloud CVE-2026-58448

Q: What is the CVSS score of CVE-2026-58448?

CVE-2026-58448 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-40416 HIGH

Missing Authorization (CWE-862)

2026-06-30 VulnCheck

GHSA-f6rh-2m88-w48m

Authentication Bypass Yudao Cloud Yunaiv

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network endpoint reachable by any authenticated low-privilege user (PR:L) with no UI; broken access control discloses sensitive workflow data (C:H) but cannot modify or disrupt it (I:N/A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:N/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 22:30 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 22:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 22:22 vuln.today

cvss_changed

Severity Changed

Jun 30, 2026 - 22:22 NVD

MEDIUM HIGH

CVSS changed

Jun 30, 2026 - 22:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

Analysis Generated

Jun 30, 2026 - 22:04 vuln.today

DescriptionCVE.org

yudao-cloud before 2026.06 contains a broken access control vulnerability in the BPM module that allows any authenticated user to access arbitrary process instance records by supplying a caller-controlled process-instance identifier to an unprotected endpoint lacking the @PreAuthorize annotation. Attackers can query any process-instance identifier through the unguarded GET endpoint to read sensitive workflow data including submitted form variables, approver identities, approval and rejection comments, and process BPMN XML without ownership or tenant party verification.

AnalysisAI

Information disclosure in the yudao-cloud BPM (business process management) module before 2026.06 lets any authenticated user read arbitrary workflow process-instance records by passing a caller-controlled process-instance ID to a GET endpoint that lacks the @PreAuthorize authorization check. Exposed data includes submitted form variables, approver identities, approval/rejection comments, and raw BPMN XML, with no ownership or tenant validation enforced. Publicly available exploit code exists and a vendor patch is available; the issue is not listed in CISA KEV.

Technical ContextAI

yudao-cloud is a Spring Cloud / Spring Boot based Java enterprise rapid-development platform whose BPM module wraps a Flowable-style workflow engine to manage approval processes. The root cause is CWE-862 (Missing Authorization): a controller method exposing process-instance retrieval omits the Spring Security @PreAuthorize annotation that gates the rest of the platform, so the framework authenticates the caller but never evaluates whether that caller owns the requested record or belongs to the same tenant. Because the process-instance identifier is supplied directly by the client and used as a lookup key without an ownership or multi-tenant party check, the endpoint returns any record regardless of who requested it. The affected component is identified by CPE cpe:2.3:a:yunaiv:yudao-cloud:*:*:*:*:*:*:*:* across all versions prior to 2026.06.

RemediationAI

Vendor-released patch: upgrade to yudao-cloud 2026.06 (jdk8/11 build) from https://github.com/YunaiV/yudao-cloud/releases, which restores the missing authorization control on the BPM process-instance endpoint. If you cannot upgrade immediately, the targeted compensating control is to add the missing @PreAuthorize authorization annotation plus an explicit ownership/tenant party check to the affected BPM process-instance GET controller method, or place that API behind a gateway/reverse-proxy rule that enforces per-tenant authorization - note this requires source or gateway access and careful testing so legitimate approvers are not blocked. As interim containment, restrict network access to the BPM endpoints to trusted internal users and tighten account self-registration so attackers cannot easily obtain the low-privilege account the attack requires, at the trade-off of reduced accessibility for remote workflow participants. Review logs for anomalous enumeration of sequential or guessed process-instance identifiers. See the VulnCheck advisory (https://www.vulncheck.com/advisories/yudao-cloud-bpm-module-broken-access-control-via-process-instance-api) for details.