CVE-2026-71807
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In RuoYi-Cloud-Plus <= 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive workflow task details and trigger unauthorized workflow executions.
Risk Assessment
Exposure of sensitive task information and the ability to trigger unauthorized business processes can lead to confidentiality and integrity breaches.
Recommendation
Update RuoYi-Cloud-Plus to the latest version that includes proper permission checks and task ownership verification.
Other vulnerabilities in RuoYi-Cloud-Plus
Original NVD description (English source)
In RuoYi-Cloud-Plus <= 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive workflow task details (/task/getTask/{taskId}) and trigger unauthorized workflow executions (/task/startWorkFlow).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS