CVE-2026-58176

Name of the Vulnerable Software and Affected Versions RuoYi-Vue-Plus versions prior to 5.6.3

Description The software exposes workflow task management endpoints under '/workflow/task' (FlwTaskController) without proper permission checks. Because the controller lacks class-level or method-level authorization annotations, these endpoints are only protected by global authentication. Consequently, any authenticated user can reassign workflow approval tasks to arbitrary users via the updateAssignee function, urge arbitrary tasks, and enumerate all pending and finished tasks through the pageByAllTaskWait and pageByAllTaskFinish listing endpoints.

Recommendations Update RuoYi-Vue-Plus to the version containing commit 88d03d9 to apply the necessary permission identifiers (SaCheckPermission) to the affected endpoints.