Description

A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategoryController/FlwSpelController/TestLeaveController of the component Workflow Endpoint. Such manipulation leads to improper authorization. The attack can be launched remotely.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-21T19:17:51.393Z",
  "pubdate": "2026-08-21T19:17:51.393Z",
  "executiveSummary": "A vulnerability classified as improper authorization has been identified in Dromara RuoYi-Vue-Plus up to version 5.6.2. This security flaw resides within the Workflow Endpoint component, specifically affecting multiple controller functions including FlwInstanceController, FlwDefinitionController, FlwCategoryController, FlwSpelController, and TestLeaveController. The vulnerability enables remote attackers to bypass access control mechanisms and execute unauthorized operations against sensitive workflow management functionalities without proper validation of user privileges.\nThe successful exploitation of this flaw poses significant risk implications to the confidentiality, integrity, and availability of the affected system, as unauthorized entities may interact with critical workflow definitions, instances, and evaluation mechanisms. The attack can be executed remotely over the network, requiring no prior authentication depending on the endpoint exposure and configuration, thereby lowering the barrier for malicious actors to compromise the application logic.\nOrganizations utilizing Dromara RuoYi-Vue-Plus up to version 5.6.2 are directly exposed to these unauthorized operations within the workflow subsystem. Immediate remediation is necessary to restrict unauthorized remote access and enforce stringent role-based access controls across all affected workflow endpoint controllers.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate or missing authorization checks within the Workflow Endpoint component of Dromara RuoYi-Vue-Plus up to version 5.6.2. Specifically, the controllers FlwInstanceController, FlwDefinitionController, FlwCategoryController, FlwSpelController, and TestLeaveController fail to properly validate whether the requesting security principal possesses the requisite permissions or roles to invoke sensitive workflow-related methods and business logic.\nThe affected component is exposed via network protocols, allowing remote attackers to send crafted HTTP requests directly to the vulnerable workflow endpoints. Because the underlying codebase lacks robust function-level or method-level authorization annotations or interceptor verifications, the application processes the incoming requests and executes the corresponding controller actions regardless of the user's privilege level or authentication state.\nThe attack flow proceeds as follows: First, an unauthenticated or low-privileged remote attacker identifies the exposed workflow endpoint routes associated with the vulnerable controllers. Second, the attacker crafts malicious HTTP payloads targeting specific functions within FlwInstanceController, FlwDefinitionController, FlwCategoryController, FlwSpelController, or TestLeaveController. Third, the application routes the request to the target controller without enforcing proper security context validations. Finally, the controller executes the requested workflow manipulation or evaluation logic, granting the attacker unauthorized access to workflow definitions, process instances, categorical data, or expression evaluations.\nThe post-exploitation impact includes the potential manipulation of business processes, unauthorized creation or deletion of workflow definitions and instances, execution of arbitrary Spring Expression Language (SpEL) evaluations via FlwSpelController, and interaction with test interfaces such as TestLeaveController that may leak internal application data or alter operational states. The vulnerability highlights a systemic failure in enforcing access control boundaries across the entire Workflow Endpoint architecture of the specified product versions."
}