yudao-cloud EUVD-2026-40416

The attacker must hold a valid authenticated session (CVSS PR:L - any low-privilege user account, no admin rights), and the target must run a yudao-cloud build before 2026.06 with the BPM module enabled and its process-instance GET endpoint network-reachable. The specific prerequisite is the affected unprotected endpoint that retrieves a process instance by a caller-supplied process-instance identifier without the @PreAuthorize annotation or any ownership/tenant party verification. No user interaction and no special non-default configuration are required beyond using the BPM workflow feature; the principal limiting factor is the need for at least one authenticated account, so deployments with closed registration and strict account governance materially reduce exposure.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, base 7.1) describes a network-reachable, low-complexity attack requiring low privileges (any valid account) and no user interaction, with high confidentiality impact but no integrity or availability impact - consistent with an authorization-only data-leak flaw. This is a credible, easily automatable disclosure risk in multi-tenant deployments: an authenticated tenant user can enumerate process-instance IDs and harvest other tenants' or users' workflow data. Publicly available exploit code raises practical urgency, but the flaw is not in CISA KEV and no EPSS score was supplied, so there is no confirmation of widespread active exploitation - current evidence points to opportunistic or targeted abuse rather than mass campaigns. The main mitigating factor is PR:L: an attacker needs at least one valid (possibly self-registered) account, so exposure is highest where account provisioning is open or where many tenants share one instance.

An attacker registers or obtains any low-privilege account on a yudao-cloud deployment, authenticates, and issues GET requests to the unguarded BPM process-instance endpoint while iterating through process-instance identifiers. Because no ownership or tenant check runs, each request returns another user's or tenant's workflow data - form submissions, approver names, and approval/rejection comments - which the attacker scripts into a bulk harvest. Publicly available exploit code lowers the effort, and the low attack complexity makes the enumeration trivial to automate.