Answer in brief
CVE-2026-58176 records a High severity (CVSS 7.1) vulnerability in RuoYi-Vue-Plus - Missing Authorization on Workflow Task Management Endpoints. The current sources do not mark it as known exploited. The current feed maps dromara/RuoYi-Vue-Plus (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps dromara/RuoYi-Vue-Plus (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| dromara/RuoYi-Vue-Plusgeneric | >=0 <=5.6.2 | Not reported |
Published upstream
Jun 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 30, 2026
RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management endpoints under /workflow/task (FlwTaskController) without any permission check: the controller declares no class-level or method-level authorization annotation, so the endpoints are gated only by global authentication. Any authenticated user, regardless of assigned role, can therefore reassign workflow approval tasks to arbitrary users via updateAssignee (defeating segregation of duties in the approval process), urge arbitrary tasks, and enumerate all pending and finished tasks via the pageByAllTaskWait and pageByAllTaskFinish listing endpoints. The issue was resolved by adding permission identifiers (SaCheckPermission) to these endpoints.
Quoted source text, attributed separately from HOL analysis.