CVE-2026-77795
Received Received - Intake

Improper Authorization in RuoYi-Vue-Plus Workflow Endpoint

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: VulDB

Description
A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategoryController/FlwSpelController/TestLeaveController of the component Workflow Endpoint. Such manipulation leads to improper authorization. The attack can be launched remotely.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-77795
EUVD
EUVD-2026-64045

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
dromara ruoyi_vue_plus to 5.6.2 (inc)
dromara ruoyi-vue-plus to 5.6.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77795 is an improper authorization vulnerability in Dromara RuoYi-Vue-Plus up to version 5.6.2. It affects multiple workflow controller endpoints due to coarse-grained permission checks using @SaCheckPermission annotations. These checks verify role or menu permissions but fail to enforce data ownership validation at the service layer.

Detection Guidance

Check for endpoints in RuoYi-Vue-Plus controllers like FlwInstanceController, FlwDefinitionController, FlwCategoryController, FlwSpelController, and TestLeaveController. Look for requests manipulating identifiers such as businessId, instanceId, or definitionId without proper ownership validation.

Impact Analysis

Authenticated users with specific permissions can manipulate identifiers like businessId or instanceId to access, modify, or delete data belonging to other users within the same tenant. This could lead to unauthorized data exposure, modification, or deletion, effectively enabling horizontal privilege escalation.

Compliance Impact

This vulnerability could violate data protection requirements under GDPR and HIPAA by enabling unauthorized access to sensitive user data. It undermines principles of least privilege, data integrity, and confidentiality, potentially leading to compliance breaches and regulatory penalties.

Mitigation Strategies

Update RuoYi-Vue-Plus to the latest version beyond 5.6.2. Implement fine-grained data ownership checks in service-layer methods. Replace @SaCheckPermission with role-based checks that verify resource ownership before processing requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77795. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart