WorkFlow-Engine EUVD-2026-98949

Exploitation requires an authenticated low-privilege account on the WorkFlow-Engine application plus knowledge of a valid target taskId, which the attacker supplies to the complete, completeTask, or reAssign handlers under the /vue/buttonOperation endpoints. There is no user interaction from the victim and no special non-default configuration required - the authorization check is simply absent in ButtonOperationRestController/CustomTaskServiceImpl. The principal limiting factors are: valid authentication is mandatory (PR:L, so not exploitable by anonymous/unauthenticated attackers), the attacker must obtain or enumerate a known taskId, and impact is confined to task-approval/reassignment integrity (no data disclosure or denial of service). Risk is meaningful only in deployments with multiple distinct users whose workflow tasks carry business significance.

This is a missing-authorization (IDOR, CWE-639) flaw rated CVSS 7.1 under the vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N). The signals are internally consistent: network vector, low attack complexity, and low-privilege authentication (PR:L) with no user interaction, impacting integrity only (VI:H) while confidentiality and availability are untouched - which fits a vulnerability that lets an authenticated user approve or reassign another user's workflow tasks rather than steal or destroy data. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or widespread automated attack; the only exploitation enabler is low. This places it as a moderate, authenticated access-control issue rather than a drop-everything priority: real risk is highest in multi-tenant/multi-user deployments where approval integrity matters (e.g., financial or administrative approval workflows), but any attacker still needs a valid low-privilege account and a known taskId. Note that the input tag 'Authentication Bypass' conflicts with the actual weakness (CWE-639 is an authorization flaw requiring an already-authenticated user), so the vulnerability class should be read as broken access control, not authentication bypass.

A low-privileged but authenticated user of the WorkFlow-Engine application discovers or guesses the taskId of a workflow task assigned to a colleague. They send a crafted request to a /vue/buttonOperation endpoint (complete, completeTask, or reAssign) supplying that taskId, causing the system to approve the task or reassign it to themselves without any authorization check. No public exploit code is identified in the provided data, but the attack requires only standard authenticated access and knowledge of a target taskId.