RuoYi-Vue-Plus CVE-2026-77795

Exploitation requires an authenticated session with at minimum a low-privilege user account on the target RuoYi-Vue-Plus application (PR:L per CVSS 4.0). The workflow module must be deployed and its endpoints accessible - installations that have not enabled the workflow feature or that have removed the workflow controllers from their deployment are not affected. No special network position is required beyond being able to reach the application's HTTP interface (AV:N, AC:L). Limiting factors: unauthenticated exploitation is not indicated by the CVSS vector; attackers must possess valid credentials. Deployments that enforce strict role-based access controls via a WAF or API gateway in front of workflow endpoints may reduce exploitability. The VulDB 'Authentication Bypass' tag and the PR:L CVSS metric are in partial tension - the precise privilege level at which bypass occurs (e.g., any registered user vs. a specific role) is not confirmed from available data and should be verified with the vendor.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3, reflecting network-reachable, low-complexity exploitation requiring only a low-privilege authenticated session. The impact metrics (VC:L/VI:L/VA:L) indicate limited but real confidentiality, integrity, and availability effects on the vulnerable system. No subsequent-system impact is identified. The VulDB tag labels this 'Authentication Bypass,' which partially conflicts with PR:L - the most accurate reading is privilege escalation or authorization bypass: an authenticated low-privilege user bypasses access controls to reach higher-privilege workflow functions, not a bypass of authentication entirely. EPSS data is not provided; however, given the niche deployment footprint and the absence of CISA KEV listing, real-world exploitation probability is currently low. A GitHub issue (https://github.com/SunRisexyz/Vul-of-Ruoyi/issues/1) suggests a researcher has documented the flaw, which may lower the barrier for exploitation but does not confirm weaponized code. The FlwSpelController is the highest-risk sub-component - if SpEL expression input is user-controlled and reachable post-auth-bypass, impact could exceed the stated VC:L/VI:L metrics; this warrants verification with the vendor.

An attacker with a standard low-privilege account on a RuoYi-Vue-Plus 5.6.x deployment sends crafted HTTP requests directly to the workflow management REST endpoints, bypassing the authorization checks that should restrict these actions to higher-privileged roles such as workflow administrators. This allows the attacker to enumerate workflow definitions, modify workflow instances, or potentially submit expressions to the SpEL endpoint - all without the required privilege level. A researcher GitHub issue documents the vulnerability, lowering the bar for replication.