CyberRota Analysis
AI-GeneratedThe ruoyi-workflow module in RuoYi-Cloud-Plus versions up to 2.6.2 is vulnerable due to insufficient permission checks in core task APIs, allowing authenticated low-privileged remote attackers to access sensitive task details and initiate unauthorized workflow executions. This vulnerability poses a risk of data exposure and unauthorized actions within the workflow management system. Organizations using this software should prioritize remediation to protect against potential exploitation by malicious insiders.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In RuoYi-Cloud-Plus <= 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive workflow task details (/task/getTask/{taskId}) and trigger unauthorized workflow executions (/task/startWorkFlow).