---
id: CVE-2026-58448
title: >-
  yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance
  API
summary: >-
  yudao-cloud before 2026.06 contains a broken access control vulnerability in
  the BPM module that allows any authenticated user to access arbitrary process
  instance records by supplying a caller-controlled process-instance identifier
  to a…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: YunaiV
product: yudao-cloud
affected:
  - yudao-cloud < 2026.06
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-01T14:53:01.049235Z'
exploitAvailable: true
published: '2026-06-30'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:07:02.258Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-58448'
references:
  - url: 'https://github.com/YunaiV/yudao-cloud/releases#release-v2026.06(jdk8/11)'
    label: Release Notes
  - url: 'https://github.com/YunaiV/yudao-cloud/issues/315'
    label: Researcher Disclosure
  - url: >-
      https://www.vulncheck.com/advisories/yudao-cloud-bpm-module-broken-access-control-via-process-instance-api
tags:
  - cve.org
  - exploit-available
epss: 0.00402
epssPercentile: 0.34668
ingestedAt: '2026-11-08T14:51:22.293Z'
---

## Overview

yudao-cloud before 2026.06 contains a broken access control vulnerability in the BPM module that allows any authenticated user to access arbitrary process instance records by supplying a caller-controlled process-instance identifier to an unprotected endpoint lacking the @PreAuthorize annotation. Attackers can query any process-instance identifier through the unguarded GET endpoint to read sensitive workflow data including submitted form variables, approver identities, approval and rejection comments, and process BPMN XML without ownership or tenant party verification.

## Affected

- `yudao-cloud < 2026.06`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.