---
id: CVE-2026-58176
title: RuoYi-Vue-Plus - Missing Authorization on Workflow Task Management Endpoints
summary: >-
  RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task
  management endpoints under /workflow/task (FlwTaskController) without any
  permission check: the controller declares no class-level or method-level
  authorization…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: dromara
product: RuoYi-Vue-Plus
affected:
  - RuoYi-Vue-Plus <= 5.6.2
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-01T14:37:56.956228Z'
exploitAvailable: true
published: '2026-06-30'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:06:54.715Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-58176'
references:
  - url: 'https://github.com/dromara/RuoYi-Vue-Plus/issues/44'
    label: Researcher Disclosure
  - url: >-
      https://github.com/dromara/RuoYi-Vue-Plus/commit/88d03d970d4d1e96e4fb2dfefaf19f627e8673e9
    label: Fix Commit
  - url: >-
      https://www.vulncheck.com/advisories/ruoyi-vue-plus-missing-authorization-on-workflow-task-management-endpoints
tags:
  - cve.org
  - exploit-available
epss: 0.0032
epssPercentile: 0.25144
ingestedAt: '2026-11-08T14:51:22.300Z'
---

## Overview

RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management endpoints under /workflow/task (FlwTaskController) without any permission check: the controller declares no class-level or method-level authorization annotation, so the endpoints are gated only by global authentication. Any authenticated user, regardless of assigned role, can therefore reassign workflow approval tasks to arbitrary users via updateAssignee (defeating segregation of duties in the approval process), urge arbitrary tasks, and enumerate all pending and finished tasks via the pageByAllTaskWait and pageByAllTaskFinish listing endpoints. The issue was resolved by adding permission identifiers (SaCheckPermission) to these endpoints.

## Affected

- `RuoYi-Vue-Plus <= 5.6.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.