Authorization Bypass in RuoYi-Vue-Plus Workflow Management
CVE-2026-58176

7.1HIGH

Key Information:

Vendor

Dromara

Status
Ruoyi-vue-plus
Vendor
CVE Published:
30 June 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-58176?

RuoYi-Vue-Plus versions up to 5.6.2 have a significant security flaw where workflow task management endpoints lack proper authorization checks. This vulnerability allows any authenticated user, regardless of their role, to manipulate task assignments, circumventing the intended separation of duties in approval workflows. Specifically, users can reassign approval tasks to any user, trigger arbitrary tasks, and view both pending and completed tasks through specific listing endpoints. The issue has been addressed by implementing necessary permission checks to secure these endpoints.

Affected Version(s)

RuoYi-Vue-Plus 0 <= 5.6.2

RuoYi-Vue-Plus 88d03d970d4d1e96e4fb2dfefaf19f627e8673e9

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-58176 - Proof of Concept

References

https://github.com/dromara/RuoYi-Vue-Plus/issues/44
technical-descriptionexploit
https://github.com/dromara/RuoYi-Vue-Plus/commit/88d03d97...
patch
https://www.vulncheck.com/advisories/ruoyi-vue-plus-missi...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.