Which versions of RuoYi-Vue-Plus are affected by EUVD-2026-40356?

RuoYi-Vue-Plus versions through 5.6.2 contain broken authorization controls in workflow task endpoints, allowing any authenticated low-privilege user to manipulate approval chains by reassigning…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-40356?

Yes, a public proof-of-concept exploit is available for EUVD-2026-40356. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate EUVD-2026-40356?

Within 24 hours: Inventory RuoYi-Vue-Plus deployments and identify version; if version 5.6.2 or earlier, restrict /workflow/task endpoint access to authorized approval roles and audit recent approval logs. Within 7 days: Apply patch available per vendor advisory to upgrade beyond version 5.6.2. Within 30 days: Complete forensic review of workflow approvals during vulnerability exposure window.

RuoYi-Vue-Plus EUVD-2026-40356

Q: What is the CVSS score of EUVD-2026-40356?

EUVD-2026-40356 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-58176 HIGH

Missing Authorization (CWE-862)

2026-06-30 VulnCheck

GHSA-mqqv-459v-978p

Authentication Bypass Ruoyi Vue Plus Dromara

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

PR:L reflects required authentication; C:L added over NVD C:N because task enumeration endpoints expose operational approval-queue data; I:H retained for workflow reassignment.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 17:23 vuln.today

Severity Changed

Jun 30, 2026 - 17:22 NVD

MEDIUM HIGH

CVSS changed

Jun 30, 2026 - 17:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

DescriptionCVE.org

RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management endpoints under /workflow/task (FlwTaskController) without any permission check: the controller declares no class-level or method-level authorization annotation, so the endpoints are gated only by global authentication. Any authenticated user, regardless of assigned role, can therefore reassign workflow approval tasks to arbitrary users via updateAssignee (defeating segregation of duties in the approval process), urge arbitrary tasks, and enumerate all pending and finished tasks via the pageByAllTaskWait and pageByAllTaskFinish listing endpoints. The issue was resolved by adding permission identifiers (SaCheckPermission) to these endpoints.

AnalysisAI

Broken function-level authorization in RuoYi-Vue-Plus through 5.6.2 allows any authenticated low-privileged user to manipulate workflow approval tasks - including reassigning pending approvals to arbitrary users, urging tasks, and enumerating all pending and completed tasks - by exploiting the absence of permission annotations on FlwTaskController endpoints under /workflow/task. This directly defeats segregation of duties in organizational approval chains, enabling a standard user to redirect approvals meant for specific roles and potentially approve transactions or actions they should never have authority over. A publicly available exploit is referenced in the project's GitHub issue tracker; no CISA KEV listing has been confirmed at time of analysis, suggesting targeted rather than widespread exploitation.

Technical ContextAI

RuoYi-Vue-Plus is a Java-based enterprise back-office management framework by the Dromara open-source community, built on Spring Boot with Sa-Token for access control and a Vue-based frontend. The affected component is FlwTaskController, which exposes REST endpoints under /workflow/task for managing workflow approval tasks. The root cause is CWE-862 (Missing Authorization): the controller declares neither a class-level @SaCheckPermission annotation nor any method-level authorization guard on its endpoints, meaning the application's global authentication filter is the only barrier - any holder of a valid session token can reach these endpoints regardless of assigned role. The fix in commit 88d03d9 resolves this by adding explicit SaCheckPermission identifiers to each sensitive endpoint. Affected product CPE is cpe:2.3:a:dromara:ruoyi-vue-plus:*:*:*:*:*:*:*:*, covering all versions through 5.6.2.

RemediationAI

Apply the upstream fix from commit 88d03d970d4d1e96e4fb2dfefaf19f627e8673e9 (https://github.com/dromara/RuoYi-Vue-Plus/commit/88d03d970d4d1e96e4fb2dfefaf19f627e8673e9), which adds SaCheckPermission annotations to the sensitive workflow task endpoints; note that a specific patched release version number has not been independently confirmed beyond this commit, so operators should verify their build incorporates this change. Consult the VulnCheck advisory at https://www.vulncheck.com/advisories/ruoyi-vue-plus-missing-authorization-on-workflow-task-management-endpoints for additional guidance. As a compensating control before patching, restrict the /workflow/task path to only workflow-administrator roles via API gateway ACLs, reverse proxy rules (e.g., nginx location blocks with IP or header-based allowlisting), or Spring Security configuration - this trades operational complexity for containment but does not fix the underlying code defect. If the workflow module is not actively used, disabling or undeploying FlwTaskController endpoints entirely eliminates exposure with no trade-off.