CVE-2026-58176
- Source
- https://cve.org/CVERecord?id=CVE-2026-58176
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58176.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-58176
- Published
- 2026-06-30T15:56:17Z
- Modified
- 2026-08-12T16:41:35Z
- Severity
-
- 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- RuoYi-Vue-Plus - Missing Authorization on Workflow Task Management Endpoints
- Details
-
RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management endpoints under /workflow/task (FlwTaskController) without any permission check: the controller declares no class-level or method-level authorization annotation, so the endpoints are gated only by global authentication. Any authenticated user, regardless of assigned role, can therefore reassign workflow approval tasks to arbitrary users via updateAssignee (defeating segregation of duties in the approval process), urge arbitrary tasks, and enumerate all pending and finished tasks via the pageByAllTaskWait and pageByAllTaskFinish listing endpoints. The issue was resolved by adding permission identifiers (SaCheckPermission) to these endpoints.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-862" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58176.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58176.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-58176
- https://www.vulncheck.com/advisories/ruoyi-vue-plus-missing-authorization-on-workflow-task-management-endpoints
- https://github.com/dromara/RuoYi-Vue-Plus/commit/88d03d970d4d1e96e4fb2dfefaf19f627e8673e9
- https://github.com/dromara/RuoYi-Vue-Plus
- https://github.com/dromara/RuoYi-Vue-Plus/issues/44
Affected packages
Git / github.com/dromara/ruoyi-vue-plus
Affected versions
v5.*
v5.0.0
v5.1.0
v5.2.1
v5.2.2
v5.2.3
v5.3.0
v5.3.1
v5.4.0
v5.4.1
v5.4.2
v5.5.0
v5.5.1
v5.5.2
v5.5.3
v5.6.0
v5.6.1
v5.6.2
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58176.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"25432239355624296370593374600908359284",
"180556902542084659150850531556096049360",
"81390300240730300151959769509725790844",
"31072165730629398742858348921108554580",
"53234962179367127439821049644939361507",
"270114439580031822601537457837702307374",
"173068598405128779622413264999509975998",
"18415328011749886578090854049019235683",
"102112862777740020169903816239588636433",
"244150806449826694205523410200361638505"
],
"threshold": 0.9
},
"id": "CVE-2026-58176-18c333d4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/dromara/ruoyi-vue-plus/commit/8136a0191a2258c0e1b36a8146a1c5ebc070c139",
"target": {
"file": "ruoyi-modules/ruoyi-generator/src/main/java/org/dromara/generator/controller/GenController.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "160343111819144759590649014792590194771",
"length": 295
},
"id": "CVE-2026-58176-1ce9a88d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/dromara/ruoyi-vue-plus/commit/8136a0191a2258c0e1b36a8146a1c5ebc070c139",
"target": {
"file": "ruoyi-modules/ruoyi-generator/src/main/java/org/dromara/generator/service/GenTableServiceImpl.java",
"function": "updateGenTable"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"20187485394580756688598743196913171397",
"23967177076964452854408128792987532745",
"312164007290475083234267426122765014352",
"315218135344474493619868269713837252720",
"48641970300062620898949893690982097051",
"207560240981917819156200618897704351146",
"188425632791383080105889251658058021879",
"2924938956165986650305568009161145580",
"186047831144300568619947167997275718712",
"321940188920845959930984652569352060229",
"2192314973947238974246440958337238437",
"154065097079425801941719621901631018916",
"61986701856739620265009962998083832951",
"28959612285167049808673878404809610984",
"87521359999425914691928916324965978877",
"339319997455295992305957854386230352970",
"180024909401431733840588725702604155173",
"54768196437186785786448275162027481939",
"93044732946057491486392185436415613258",
"214113504612664810131196351422800368470",
"147604718114855238879509044906052463136",
"206440487931992264425931113741432631402",
"12211669563436289550656467510954850106",
"32628857917562661853390000202780303472",
"236150407334411809439945507934434002686",
"16795327550792570174784209656393521828",
"180024909401431733840588725702604155173",
"54768196437186785786448275162027481939",
"93044732946057491486392185436415613258",
"214113504612664810131196351422800368470",
"147604718114855238879509044906052463136",
"126975911921650567355546962049995451633",
"68178404012045869754093997953155541580",
"169881672749587890968739687344101045001",
"257142133649921358395800199949264840737",
"115077695132100881930609167305222174390",
"105652719237159594693982138324309311102",
"209366940399615112530003203016043043574",
"138531336355367200989862029485569233319"
],
"threshold": 0.9
},
"id": "CVE-2026-58176-1d557022",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/dromara/ruoyi-vue-plus/commit/8136a0191a2258c0e1b36a8146a1c5ebc070c139",
"target": {
"file": "ruoyi-common/ruoyi-common-mybatis/src/main/java/org/dromara/common/mybatis/helper/DataBaseHelper.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "114893552895949726107472741586101099498",
"length": 274
},
"id": "CVE-2026-58176-2fc5733b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/dromara/ruoyi-vue-plus/commit/8136a0191a2258c0e1b36a8146a1c5ebc070c139",
"target": {
"file": "ruoyi-common/ruoyi-common-mybatis/src/main/java/org/dromara/common/mybatis/helper/DataBaseHelper.java",
"function": "getDataBaseType"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"211426699086135322356840675042769015654",
"62675914263265890480827122022546772126",
"126130755864381350198331061083196516006",
"314420970737699192667070799271688752051",
"61601366866357738198654235656991634417",
"51750439121806635206730645902972981184",
"165540481265118886769419116635890734413",
"270006214015557244779965277560746697739",
"261372201838057305055700002652112430179",
"16353497103628458085847809848706006232",
"207233763366634320568536570661551979224",
"94733906042492254071918116267479947336",
"327530441753446949679840424311281177849",
"317647003112689760579709184712638342253",
"300229530988118377269459645622594480243"
],
"threshold": 0.9
},
"id": "CVE-2026-58176-40b35bf2",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/dromara/ruoyi-vue-plus/commit/88d03d970d4d1e96e4fb2dfefaf19f627e8673e9",
"target": {
"file": "ruoyi-modules/ruoyi-workflow/src/main/java/org/dromara/workflow/controller/FlwTaskController.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "314931600314538480780017923403091879523",
"length": 740
},
"id": "CVE-2026-58176-6032638f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/dromara/ruoyi-vue-plus/commit/8136a0191a2258c0e1b36a8146a1c5ebc070c139",
"target": {
"file": "ruoyi-modules/ruoyi-generator/src/main/java/org/dromara/generator/service/GenTableServiceImpl.java",
"function": "generatorCode"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "285327859716246264223058082029866878676",
"length": 128
},
"id": "CVE-2026-58176-75b4eae3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/dromara/ruoyi-vue-plus/commit/8136a0191a2258c0e1b36a8146a1c5ebc070c139",
"target": {
"file": "ruoyi-modules/ruoyi-generator/src/main/java/org/dromara/generator/controller/GenController.java",
"function": "genCode"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"121123418020282054110399941594565540904",
"90927506891212867083801979778791708578",
"299905862442135014851049493761788576465",
"40960947384460855967696151165915608494"
],
"threshold": 0.9
},
"id": "CVE-2026-58176-7e4b3f89",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/dromara/ruoyi-vue-plus/commit/8136a0191a2258c0e1b36a8146a1c5ebc070c139",
"target": {
"file": "ruoyi-modules/ruoyi-generator/src/main/java/org/dromara/generator/service/IGenTableService.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"121880746095188087296241299996871078825",
"133442355424832727426666775028108124868",
"173916910187124280173414163671693811568",
"57873375965137681848699253489192838303",
"10575284932307322848965292991134247528",
"304827469756515942294904613635015276012",
"328527982136017068244862518841758769920",
"290666048643803464414200380217013438749",
"57841801709923128956011723345855554111",
"204799223186517589476515797752149368745",
"161925805419478035503389684655080409795",
"296935918650253763959956909796484584557",
"6435465002064172730955701171103500485",
"184689322269632248402271126295402296793",
"272455076266910218985284118051038827291",
"323741068487932760562856778835801651793",
"182246732152242903624342252593289097177",
"218509598184372013940136507267159918527",
"55645339677596853958624083233793595965",
"266511491138775551399643515937353788883",
"300205036017482257997812146628535499638",
"310260548460917892577450747485097304958",
"324739084951005671853383599301377902331",
"190497590682932604975459831899867444999",
"66139831500787638411922089768468369097",
"230131802082383148745957949636230958949",
"30043299643696676983601807399100100738",
"251984119499169616773527946498187571086",
"244759677460639000628181865981244641137",
"197331117963683517632235852126488392628",
"235198258836993370697534269428949109391",
"62628318254514879746600312502441242533",
"108587633537507210242609878158511307392",
"261580931148373329721175149379456372497",
"219884395298591932084822420281771561798",
"210526989612711455208517966461246869086",
"94212369301595917495916831004431658471",
"201732835704205858018505660460444055433",
"147991022752811549235741235352433448908",
"202608808130304130001922984702400963590",
"237031272142704837663611790358183874742",
"55125814634493229996385435675739197387",
"57713252680193271513287241528885913043",
"332363874166325515639411083372449867764"
],
"threshold": 0.9
},
"id": "CVE-2026-58176-80e56b4d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/dromara/ruoyi-vue-plus/commit/8136a0191a2258c0e1b36a8146a1c5ebc070c139",
"target": {
"file": "ruoyi-modules/ruoyi-generator/src/main/java/org/dromara/generator/service/GenTableServiceImpl.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"20922952455462485532035615155425650012",
"72260795379794621760020707756984979444",
"338422591718526794445187269599578334677",
"290327897171817379348145441668209358787"
],
"threshold": 0.9
},
"id": "CVE-2026-58176-a4a13d31",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/dromara/ruoyi-vue-plus/commit/8136a0191a2258c0e1b36a8146a1c5ebc070c139",
"target": {
"file": "ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/domain/bo/SysUserBo.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "105748282782062136840295820567280427300",
"length": 341
},
"id": "CVE-2026-58176-ba90533e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/dromara/ruoyi-vue-plus/commit/8136a0191a2258c0e1b36a8146a1c5ebc070c139",
"target": {
"file": "ruoyi-modules/ruoyi-generator/src/main/java/org/dromara/generator/service/GenTableServiceImpl.java",
"function": "getGenPath"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "100644202843265547713666274581310935695",
"length": 283
},
"id": "CVE-2026-58176-bf02cf91",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/dromara/ruoyi-vue-plus/commit/8136a0191a2258c0e1b36a8146a1c5ebc070c139",
"target": {
"file": "ruoyi-common/ruoyi-common-core/src/main/java/org/dromara/common/core/utils/sql/SqlUtil.java",
"function": "filterKeyword"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "98679454629874085588103675620790875562",
"length": 292
},
"id": "CVE-2026-58176-cb48d9b9",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/dromara/ruoyi-vue-plus/commit/8136a0191a2258c0e1b36a8146a1c5ebc070c139",
"target": {
"file": "ruoyi-common/ruoyi-common-mybatis/src/main/java/org/dromara/common/mybatis/helper/DataBaseHelper.java",
"function": "getDataBaseType"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "159524446992307317594975841091182667192",
"length": 459
},
"id": "CVE-2026-58176-d7660309",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/dromara/ruoyi-vue-plus/commit/8136a0191a2258c0e1b36a8146a1c5ebc070c139",
"target": {
"file": "ruoyi-common/ruoyi-common-mybatis/src/main/java/org/dromara/common/mybatis/helper/DataBaseHelper.java",
"function": "findInSet"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"198981315873089269140025418749320552904",
"256130899550469690571507543944296634843",
"148878741904345760720424939456779857188",
"78002230422600066939183915186638928442",
"23803196516737678720152331177309659335",
"236723644179471253250238856909552866925",
"163625970215978477105665670681307669649",
"301028113420081537026444006004842331020",
"237558962397774012463881172773909213525",
"266595828266169374351863612306304263275",
"73604767982874725964972880522338754260",
"258818404839208556978961696967472103196",
"111012372240719763461079765631565791753",
"151354259351972474160079582949980232370",
"6220596267110541334895576362917542297",
"108587633537507210242609878158511307392"
],
"threshold": 0.9
},
"id": "CVE-2026-58176-dba6afb7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/dromara/ruoyi-vue-plus/commit/8136a0191a2258c0e1b36a8146a1c5ebc070c139",
"target": {
"file": "ruoyi-common/ruoyi-common-core/src/main/java/org/dromara/common/core/utils/sql/SqlUtil.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "319139580013415282259075109261336158755",
"length": 554
},
"id": "CVE-2026-58176-e29b175c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/dromara/ruoyi-vue-plus/commit/8136a0191a2258c0e1b36a8146a1c5ebc070c139",
"target": {
"file": "ruoyi-modules/ruoyi-workflow/src/main/java/org/dromara/workflow/listener/WorkflowGlobalListener.java",
"function": "processTaskPermission"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"322989560351616976641444998494165412254",
"82975633876913482738416421018987840905",
"57594843955744578854427465677384939524",
"257807793920570385230850888323688622730",
"334642804023120504816856551967908068726"
],
"threshold": 0.9
},
"id": "CVE-2026-58176-f5288815",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/dromara/ruoyi-vue-plus/commit/8136a0191a2258c0e1b36a8146a1c5ebc070c139",
"target": {
"file": "ruoyi-modules/ruoyi-workflow/src/main/java/org/dromara/workflow/listener/WorkflowGlobalListener.java"
}
}
]
vanir_signatures_modified
"2026-08-12T16:41:35Z"