EUVD-2026-75208
GHSA-rv64-rv32-9xg6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
In RuoYi-Cloud-Plus <= 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive workflow task details (/task/getTask/{taskId}) and trigger unauthorized workflow executions (/task/startWorkFlow).
AnalysisAI
Missing authorization checks in the ruoyi-workflow module of RuoYi-Cloud-Plus 2.6.2 and earlier allow any authenticated user with a low-privilege account to read workflow task details belonging to other users via /task/getTask/{taskId} and to trigger workflow executions they are not entitled to start via /task/startWorkFlow. The FlwTaskController endpoints carry no permission annotations and the service layer never verifies that the caller is the task handler or a related user, so the only barrier is possession of a valid account. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today