CVE-2026-58176

{
  "id": "CVE-2026-58176",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-30T17:16:24.720",
  "lastModified": "2026-10-25T21:10:00.770",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management endpoints under /workflow/task (FlwTaskController) without any permission check: the controller declares no class-level or method-level authorization annotation, so the endpoints are gated only by global authentication. Any authenticated user, regardless of assigned role, can therefore reassign workflow approval tasks to arbitrary users via updateAssignee (defeating segregation of duties in the approval process), urge arbitrary tasks, and enumerate all pending and finished tasks via the pageByAllTaskWait and pageByAllTaskFinish listing endpoints. The issue was resolved by adding permission identifiers (SaCheckPermission) to these endpoints."
    },
    {
      "lang": "es",
      "value": "RuoYi-Vue-Plus hasta la versión 5.6.2, corregido en el commit 88d03d9, expone puntos finales de gestión de tareas de flujo de trabajo bajo /workflow/task (FlwTaskController) sin ninguna verificación de permisos: el controlador no declara ninguna anotación de autorización a nivel de clase o de método, por lo que los puntos finales están protegidos únicamente por la autenticación global. Cualquier usuario autenticado, independientemente del rol asignado, puede por lo tanto reasignar tareas de aprobación de flujo de trabajo a usuarios arbitrarios a través de updateAssignee (frustrando la segregación de funciones en el proceso de aprobación), instar tareas arbitrarias, y enumerar todas las tareas pendientes y finalizadas a través de los puntos finales de listado pageByAllTaskWait y pageByAllTaskFinish. El problema se resolvió añadiendo identificadores de permiso (SaCheckPermission) a estos puntos finales."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "dromara",
          "product": "RuoYi-Vue-Plus",
          "defaultStatus": "unaffected",
          "repo": "https://github.com/dromara/RuoYi-Vue-Plus",
          "packageURL": "pkg:github/dromara/RuoYi-Vue-Plus",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "5.6.2",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "88d03d970d4d1e96e4fb2dfefaf19f627e8673e9",
              "versionType": "git",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-01T14:37:56.956228Z",
          "id": "CVE-2026-58176",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/dromara/RuoYi-Vue-Plus/commit/88d03d970d4d1e96e4fb2dfefaf19f627e8673e9",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/dromara/RuoYi-Vue-Plus/issues/44",
      "source": "[email protected]"
    },
    {
      "url": "https://www.vulncheck.com/advisories/ruoyi-vue-plus-missing-authorization-on-workflow-task-management-endpoints",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/dromara/RuoYi-Vue-Plus/issues/44",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}