CVE-2026-110118: WorkFlow-Engine through 9.6.11 Missing Authorization via flowableui buttonOperation Endpoints
WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the complete, completeTask or reAssign handlers to approve tasks or reassign them without authority.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Authenticated low-privileged users are exposed as potential attackers if they can reach the /vue/buttonOperation endpoints and know a target workflow taskId. The issue affects WorkFlow-Engine through version 9.6.11.
What does an attacker need to exploit it?
The attacker needs valid authentication and a known taskId for another user's workflow task. They can submit that taskId to the complete, completeTask, or reAssign handlers without needing authority over the task.
What is the practical impact of successful exploitation?
An attacker can complete or approve another user's workflow task, or reassign that task. This can alter workflow decisions and task ownership despite the attacker lacking authorization.