Remote Code Execution in RuoYi-Vue-Plus

Executive Summary

CVE-2026-88616 is an authorization bypass vulnerability in RuoYi-Vue-Plus version 6.0.0. It allows an authenticated user with low privileges to exploit client-controlled bypass flags (ignore, ignoreDepute, ignoreCooperate) in the /workflow/task/completeTask endpoint to perform unauthorized workflow approvals or state changes without proper task-assignee restrictions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP requests to the /workflow/task/completeTask endpoint for unusual use of bypass flags (ignore, ignoreDepute, ignoreCooperate). Check server logs for task completions performed by users without proper assignee permissions.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to approve or modify workflow tasks without proper authorization, potentially altering business processes or granting unauthorized access. The attacker only needs their own account credentials and a valid task ID, not those of the legitimate approver.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized workflow approvals or state changes without proper task-assignee restrictions, which could lead to unauthorized access or modifications to sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy) by enabling unauthorized processing or changes to protected information.

Useful 0 Not Useful 0

Mitigation Strategies

Implement server-side authorization checks before workflow engine invocation. Reject client-controlled ignore flags during task completion. Update to a patched version if available. Restrict access to the /workflow/task/completeTask endpoint.

Useful 0 Not Useful 0