CVE-2026-58176 RuoYi-Vue-Plus - Missing Authorization on Workflow Task Management Endpoints
Authenticated users can bypass authorization to reassign workflow tasks and enumerate all pending or finished tasks in RuoYi-Vue-Plus.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-58176?
CVE-2026-58176 is a high-severity missing authorization vulnerability in dromara RuoYi-Vue-Plus, published on 30 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management endpoints under /workflow/task (FlwTaskController) without any permission check: the controller declares no class-level or method-level authorization annotation, so the endpoints are gated only by global authentication. Any authenticated user, regardless of assigned role, can therefore reassign workflow approval tasks to arbitrary users via updateAssignee (defeating segregation of duties in the approval process), urge arbitrary tasks, and enumerate all pending and finished tasks via the pageByAllTaskWait and pageByAllTaskFinish listing endpoints. The issue was resolved by adding permission identifiers (SaCheckPermission) to these endpoints.
Weakness: CWE-862
Which versions are affected by CVE-2026-58176?
How do I fix CVE-2026-58176?
No fix has been published for CVE-2026-58176 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-58176 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-58176 exists.
Sources
Also known as GHSA-mqqv-459v-978p.