Broken Access Control in yudao-cloud BPM Module

Executive Summary

This vulnerability exists in yudao-cloud before version 2026.06 within the BPM module. It is a broken access control issue that allows any authenticated user to access arbitrary process instance records. This is possible because the GET endpoint handling process-instance identifiers lacks proper authorization checks, specifically missing the @PreAuthorize annotation.

Attackers can supply any process-instance identifier to this unprotected endpoint and retrieve sensitive workflow data without verifying ownership or tenant party. The exposed data includes submitted form variables, approver identities, approval and rejection comments, and the BPMN XML of the process.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to access the vulnerable endpoint GET /bpm/process-instance/get-bpmn-model-view with various process-instance identifiers while authenticated. If the endpoint returns sensitive workflow data without proper authorization checks, the system is vulnerable.

Commands to detect this might include using curl or similar HTTP clients to send authenticated GET requests to the endpoint with different process-instance IDs obtained from other API responses such as CRM contracts or task assignments.

• curl -H "Authorization: Bearer <token>" "https://<your-domain>/bpm/process-instance/get-bpmn-model-view?processInstanceId=<id>"

If the response includes sensitive data like form variables, approver identities, approval/rejection comments, or BPMN XML without proper permission errors, the vulnerability is present.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive workflow information. An attacker with valid authentication can access confidential data such as form inputs, identities of approvers, comments related to approvals or rejections, and detailed process definitions.

Such exposure can compromise business process confidentiality, potentially leading to information leakage, privacy violations, and undermining trust in the system's security controls.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows any authenticated user to access sensitive workflow data, including submitted form variables, approver identities, approval and rejection comments, and process BPMN XML without proper authorization or ownership verification.

This unauthorized access to sensitive data could lead to violations of data protection regulations such as GDPR and HIPAA, which require strict access controls and protection of personal and sensitive information.

Therefore, the broken access control vulnerability in yudao-cloud's BPM module may result in non-compliance with these common standards and regulations due to exposure of sensitive data to unauthorized parties.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to ensure that the vulnerable endpoint has proper authorization checks in place.

Specifically, add the @PreAuthorize("@ss.hasPermission('bpm:process-instance:query')") annotation to the getProcessInstanceBpmnModelView method in the BPM module, aligning it with other secured endpoints.

This will enforce permission checks and prevent unauthorized users from accessing arbitrary process instance records.

Additionally, review and restrict access tokens or user permissions to limit authenticated users to only their authorized data.

Useful 0 Not Useful 0