CVE-2026-71807: Ruoyi-workflow (RuoYi-Cloud-Plus) vulnerability
In RuoYi-Cloud-Plus <= 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive workflow task details (/task/getTask/{taskId}) and trigger unauthorized workflow executions (/task/startWorkFlow).
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated remote user with low privileges can exploit the affected task APIs. The issue applies when the ruoyi-workflow module is present in RuoYi-Cloud-Plus versions up to and including 2.6.2.
What actions can an attacker perform?
An attacker can retrieve sensitive workflow task details through /task/getTask/{taskId}. They can also initiate unauthorized workflow executions through /task/startWorkFlow.
What access control failure causes the exposure?
Multiple core task APIs lack permission annotations, and the Service layer does not validate that the current user is the task handler or a related user. As a result, authentication alone does not enforce task-level authorization for the affected operations.