CVE-2026-58448: yudao-cloud Auth Bypass Vulnerability

CVE-2026-58448 Overview

CVE-2026-58448 is a broken access control vulnerability [CWE-862] in the yudao-cloud Business Process Management (BPM) module. Versions prior to 2026.06 expose an HTTP GET endpoint that returns process-instance records without the @PreAuthorize annotation. Any authenticated user can supply a caller-controlled process-instance identifier and retrieve records belonging to other users or tenants. The exposed data includes submitted form variables, approver identities, approval and rejection comments, and Business Process Model and Notation (BPMN) XML definitions. The vulnerability requires only low-privilege authentication and no user interaction.

Critical Impact
Authenticated attackers can enumerate arbitrary process instance identifiers to read sensitive workflow data across tenant boundaries, including form submissions, approver information, and full BPMN process definitions.

Affected Products

yudao-cloud versions prior to 2026.06
yudao-cloud BPM module (process-instance API endpoint)
Deployments running on JDK 8 and JDK 11 builds

Discovery Timeline

2026-06-30 - CVE-2026-58448 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-58448

Vulnerability Analysis

The vulnerability resides in the BPM module's process-instance retrieval endpoint. The controller method handling GET requests for process instance records lacks the @PreAuthorize annotation used elsewhere in the codebase to enforce role and ownership checks. As a result, Spring Security does not intercept these requests to validate whether the calling principal owns the requested resource. The endpoint accepts a process-instance identifier directly from client input and returns the corresponding record from the persistence layer without additional authorization logic. This maps to a classic Missing Authorization pattern classified under [CWE-862].

Root Cause

The controller method fails to invoke ownership or tenant party verification before returning process-instance data. Two enforcement layers are missing: the method-level @PreAuthorize annotation and any programmatic check that compares the current principal or tenant identifier against the record's owner. The BPM module ships multi-tenant workflow features, so the absence of tenant party validation allows cross-tenant data access in shared deployments.

Attack Vector

An attacker authenticates with any valid low-privilege account. The attacker then issues GET requests to the unguarded process-instance endpoint, iterating or guessing process-instance identifiers. Because the API returns full record payloads, each successful request discloses form variables, approver identities, approval and rejection comments, and the BPMN XML for the workflow. No user interaction from the victim is required, and the attack occurs entirely over the network.

No verified proof-of-concept code is published in the referenced advisories. See the VulnCheck Security Advisory and the GitHub Issue Report for the technical writeup.

Detection Methods for CVE-2026-58448

Indicators of Compromise

High volumes of GET requests to BPM process-instance endpoints from a single authenticated session, particularly with sequential or enumerated identifier values.
Requests to process-instance identifiers that do not correspond to any workflow the calling user has initiated or been assigned as an approver.
Application logs showing successful 200 OK responses to process-instance queries lacking prior authorization events for the same principal.

Detection Strategies

Instrument the BPM controller to log the calling principal, tenant identifier, and requested process-instance identifier, then alert on mismatches between the caller and the record owner.
Deploy a Web Application Firewall (WAF) rule to flag sequential or high-rate access to the process-instance API path.
Correlate authentication events with BPM API access patterns in a Security Information and Event Management (SIEM) platform to surface enumeration behavior.

Monitoring Recommendations

Baseline normal process-instance query rates per user role and alert on statistical deviations.
Monitor egress payload sizes from BPM endpoints; bulk data extraction produces larger cumulative responses than legitimate workflow use.
Retain full HTTP request logs for the BPM module for at least 90 days to support retrospective investigation.

How to Mitigate CVE-2026-58448

Immediate Actions Required

Upgrade yudao-cloud to version 2026.06 or later, which adds authorization enforcement on the affected endpoint.
Audit application logs for prior access to process-instance endpoints and identify accounts that queried records outside their ownership.
Rotate credentials and review approver assignments for any workflow whose BPMN XML or form variables may have been disclosed.

Patch Information

The fix is included in the yudao-cloud 2026.06 release. Refer to the GitHub Release Notes for build artifacts covering JDK 8 and JDK 11. The patch adds the missing @PreAuthorize annotation and ownership verification to the process-instance controller method.

Workarounds

Place the yudao-cloud BPM module behind a reverse proxy that enforces per-user access control lists on the process-instance API path until the upgrade is applied.
Restrict network access to the BPM endpoints to trusted internal networks or specific service accounts required for workflow operations.
Apply a temporary Spring Security configuration that requires elevated roles for all process-instance GET requests, blocking low-privilege enumeration.

bash

# Example Spring Security path restriction (temporary mitigation)
# Add to your SecurityFilterChain configuration
http.authorizeHttpRequests(auth -> auth
    .requestMatchers("/bpm/process-instance/get").hasRole("BPM_ADMIN")
    .anyRequest().authenticated()
);