RuoYi-Vue-Plus EUVD-2026-40356

Exploitation requires possession of any valid authenticated session in a RuoYi-Vue-Plus deployment running version 5.6.2 or earlier - no specific role, administrative privilege, or elevated permission is needed beyond standard login. The workflow module (FlwTaskController) must be deployed and the /workflow/task endpoints must be network-reachable. Deployments that have not enabled or are not using the workflow approval feature are not affected. No non-default configuration, special protocol, or specific platform version is required. Limiting factors: unauthenticated exploitation is blocked by global session authentication; deployments without the workflow module active are unexposed; network segmentation that prevents unauthenticated or external access to the application's API surface reduces risk.

The NVD CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N scores 6.5 (Medium), accurately capturing the low-complexity network-accessible nature and high integrity impact from workflow reassignment. However, the C:N score may understate exposure: the pageByAllTaskWait and pageByAllTaskFinish enumeration endpoints leak operational data about organizational approval queues, suggesting at least C:L is warranted in independent assessment. No EPSS score was provided in source data, so probability-of-exploitation cannot be quantitatively benchmarked. The absence of a CISA KEV listing means active widespread exploitation is not confirmed, though a publicly available exploit (GitHub issue #44) materially lowers the attacker skill threshold. The primary business risk is process integrity - not system compromise - making this a high-priority finding for any organization relying on RuoYi-Vue-Plus workflow approvals for financial, compliance, or access control decisions, and a lower priority for deployments that do not use the workflow module.

A publicly available exploit is referenced in GitHub issue #44 (https://github.com/dromara/RuoYi-Vue-Plus/issues/44). An attacker with any valid low-privileged account authenticates to the RuoYi-Vue-Plus application and sends a crafted HTTP POST to /workflow/task/updateAssignee with a target task ID and a chosen assignee user ID, rerouting a pending financial or access-control approval away from the designated approver to an account the attacker controls. The attacker then approves the diverted task through their own session, bypassing the intended multi-person authorization control, with no elevated role or special configuration required.