CVE-2026-77795: Dromara RuoYi-Vue-Plus Workflow Endpoint TestLeaveController improper authorization
A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategoryController/FlwSpelController/TestLeaveController of the component Workflow Endpoint. Such manipulation leads to improper authorization. The attack can be launched remotely.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Dromara RuoYi-Vue-Plus deployments running versions up to and including 5.6.2 are affected where the Workflow Endpoint component is exposed.
What access does an attacker need?
The vulnerability is remotely exploitable and requires low-level privileges. No user interaction is required.
Which workflow functions are involved?
The affected functions are FlwInstanceController, FlwDefinitionController, FlwCategoryController, FlwSpelController, and TestLeaveController.
What is the potential impact?
Improper authorization can affect confidentiality, integrity, and availability, each with low impact according to the supplied severity vector.