CVE-2026-110118

Deferred Deferred - Pending Action

Missing Authorization in WorkFlow-Engine Allows Task Manipulation

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the complete, completeTask or reAssign handlers to approve tasks or reassign them without authority.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110118

EUVD

EUVD-2026-98949

Affected Vendors & Products

Vendor	Product	Version / Range
risesoft-y9	WorkFlow-Engine	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-110118 is a missing authorization vulnerability in WorkFlow-Engine through version 9.6.11. It allows authenticated users to manipulate workflow tasks they do not own by supplying a known taskId to endpoints like /vue/buttonOperation/complete or /vue/buttonOperation/reAssign. This bypasses intended access controls, enabling attackers to approve or reassign tasks without proper permissions.

Detection Guidance

To detect this vulnerability, monitor HTTP requests to /vue/buttonOperation endpoints for taskId parameters. Check for unusual task completions or reassignments by low-privileged users. Review logs for unauthorized modifications to workflow tasks.

Impact Analysis

Low-privileged attackers could approve or reassign tasks belonging to other users, disrupting workflows. Sensitive processes like approvals may be manipulated without detection. Since task IDs are discoverable via monitor endpoints, attackers can target arbitrary tasks in the system.

Compliance Impact

This vulnerability could violate compliance with GDPR and HIPAA by enabling unauthorized access to sensitive workflow tasks. GDPR requires strict access controls for personal data processing, while HIPAA mandates role-based access for protected health information. The flaw allows low-privileged users to manipulate tasks they do not own, potentially exposing or altering sensitive data without proper authorization.

Mitigation Strategies

Immediately update WorkFlow-Engine to a patched version beyond 9.6.11. Implement strict authorization checks for all /vue/buttonOperation endpoints. Restrict access to monitor endpoints (/vue/monitor/*) to prevent task ID enumeration.

Hi! I’m here to help you understand CVE-2026-110118. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70