Unauthorized Workflow Task Management in RuoYi-Vue-Plus

Executive Summary

CVE-2026-58176 is a missing authorization vulnerability in RuoYi-Vue-Plus versions up to 5.6.2. The workflow task management endpoints under /workflow/task (FlwTaskController) do not have proper permission checks. Although global authentication is required, any authenticated user can access these endpoints regardless of their assigned role.

This lack of authorization allows users to reassign workflow approval tasks to arbitrary users, urge arbitrary tasks, and list all pending and finished tasks. Essentially, it defeats segregation of duties in the approval process by allowing unauthorized task management actions.

The issue was fixed by adding permission identifiers (SaCheckPermission) to the affected endpoints, ensuring only users with the appropriate permissions can perform these actions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access and manipulation of workflow tasks by any authenticated user, regardless of their role.

• Reassignment of workflow approval tasks to arbitrary users, which breaks segregation of duties.
• Ability to urge or push arbitrary tasks, potentially disrupting workflow processes.
• Enumeration of all pending and finished tasks, exposing potentially sensitive workflow information.

Overall, this can lead to privilege escalation, unauthorized task management, and potential workflow process abuse.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the workflow task management endpoints under /workflow/task are accessible to any authenticated user without proper permission checks.

You can attempt to access or invoke the following endpoints as an authenticated user to test for unauthorized access:

• Reassign workflow approval tasks via the updateAssignee endpoint.
• Urge arbitrary tasks.
• Enumerate all pending tasks using the pageByAllTaskWait endpoint.
• Enumerate all finished tasks using the pageByAllTaskFinish endpoint.

For example, you can use curl commands to test these endpoints by authenticating as a normal user and attempting to perform these actions. If these actions succeed without permission errors, the system is vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to apply the fix introduced in commit 88d03d9 which adds permission checks to the workflow task management endpoints.

This involves adding the @SaCheckPermission annotation with appropriate permission identifiers such as "workflow:task:list" and "workflow:task:edit" to the affected API endpoints in the FlwTaskController.

Additionally, update the database permission entries in the sys_menu table to include these new permission identifiers, ensuring that only authorized users can access or modify workflow tasks.

Until the fix is applied, restrict access to the /workflow/task endpoints to trusted users only or disable these endpoints if possible.

Useful 0 Not Useful 0