CVE-2026-58448Medium· 6.5▾ TwilightPoC availableyudao-cloud before 2026.06 contains a broken access control vulnerability in the BPM module that allows any authenticated user to access arbitrary process instance records by supplying a caller-controlled process-instance identifier to a…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 35.8 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.4%
yudao-cloud before 2026.06 contains a broken access control vulnerability in the BPM module that allows any authenticated user to access arbitrary process instance records by supplying a caller-controlled process-instance identifier to an unprotected endpoint lacking the @PreAuthorize annotation. Attackers can query any process-instance identifier through the unguarded GET endpoint to read sensitive workflow data including submitted form variables, approver identities, approval and rejection comments, and process BPMN XML without ownership or tenant party verification.
yudao-cloud < 2026.06Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-7679High· 7.3YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication
CVE-2026-7678Medium· 6.3YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection
CVE-2026-7710High· 7.3YunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication
CVE-2025-10275Medium· 6.3YunaiV yudao-cloud transfer improper authorization
CVE-2026-5147High· 7.3YunaiV yudao-cloud get-by-website sql injection
CVE-2026-116016High· 7.1yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header