CVE-2026-71807: RuoYi-Cloud-Plus Auth Bypass Vulnerability

CVE-2026-71807 Overview

CVE-2026-71807 is a broken access control vulnerability in RuoYi-Cloud-Plus versions 2.6.2 and earlier. The flaw resides in the ruoyi-workflow module, specifically within the FlwTaskController class. Multiple core task APIs lack permission annotations, and the service layer fails to verify whether the current user is the assigned task handler or a related user. Authenticated low-privileged remote attackers can read sensitive workflow task details via /task/getTask/{taskId} and trigger unauthorized workflow executions via /task/startWorkFlow. The issue is classified as a business logic and authorization flaw affecting multi-tenant workflow processing.

Critical Impact
Any authenticated user can enumerate workflow task data belonging to other users and initiate workflow executions outside their authorization scope.

Affected Products

RuoYi-Cloud-Plus versions <= 2.6.2
ruoyi-workflow module (FlwTaskController)
Deployments exposing workflow task APIs to authenticated users

Discovery Timeline

2026-09-09 - CVE-2026-71807 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-71807

Vulnerability Analysis

The vulnerability stems from missing authorization checks in the FlwTaskController of the ruoyi-workflow module. RuoYi-Cloud-Plus is a Spring Cloud-based rapid development platform that relies on annotation-driven permission enforcement. Endpoints such as /task/getTask/{taskId} and /task/startWorkFlow are exposed without permission annotations that would restrict access to authorized roles.

The underlying service layer compounds the issue. It does not validate whether the authenticated principal is the task assignee, delegate, or a related workflow participant before returning task data or executing workflow transitions. Any account with valid session credentials can invoke the endpoints and receive successful responses.

Exploitation yields two distinct outcomes. First, attackers read sensitive workflow task metadata including approvers, business keys, and process variables. Second, attackers trigger workflow start operations that should be gated by role or ownership checks, potentially advancing business processes such as approvals or financial transactions.

Root Cause

The root cause is missing method-level authorization. Controller methods omit annotations that would bind endpoints to specific roles or permissions. The service layer does not perform ownership validation against the task handler. This combination represents a classic Broken Access Control weakness aligned with [CWE-284] and [CWE-862].

Attack Vector

The attack vector requires network access and valid low-privileged credentials. An attacker authenticates to the RuoYi-Cloud-Plus application, enumerates task identifiers, and issues HTTP requests to the vulnerable endpoints. No user interaction from privileged users is required. Refer to the GitHub Vulnerability Issue #10 for reproduction steps and affected endpoint enumeration.

Detection Methods for CVE-2026-71807

Indicators of Compromise

Unexpected HTTP GET requests to /task/getTask/{taskId} from user accounts that are not workflow participants
HTTP POST requests to /task/startWorkFlow originating from low-privileged accounts
Sequential enumeration patterns targeting incrementing taskId values in access logs
Workflow execution events initiated by users outside the intended approver population

Detection Strategies

Correlate application access logs with role assignments to identify workflow API calls from non-authorized users
Deploy request-rate analytics on /task/* endpoints to catch enumeration behavior
Instrument audit logging in the service layer to record the acting principal against the task assignee for every workflow operation

Monitoring Recommendations

Forward RuoYi-Cloud-Plus application logs and API gateway logs to a centralized analytics platform for baseline deviation analysis
Alert on any workflow start events where the initiating user does not appear in the workflow definition
Monitor for anomalous spikes in getTask requests correlated with a single session token

How to Mitigate CVE-2026-71807

Immediate Actions Required

Restrict network exposure of the ruoyi-workflow module to trusted internal segments until a patched release is deployed
Audit user role assignments and remove unnecessary access to the workflow application
Review recent workflow start events and task queries for signs of unauthorized activity

Patch Information

No official patched release is referenced in the enriched data at the time of publication. Consult the upstream project and the GitHub Vulnerability Issue #10 for updated fix guidance. Once the maintainers release a version above 2.6.2 that adds permission annotations and service-layer ownership checks, upgrade all affected deployments.

Workarounds

Add Spring Security or Sa-Token permission annotations to FlwTaskController methods to enforce role-based access
Introduce a service-layer guard that compares the current authenticated user against the task handler and related participants before returning data or executing transitions
Place the workflow APIs behind an API gateway rule that validates role claims from the JWT before proxying requests
Disable unused workflow endpoints if they are not required for the current deployment

bash

# Configuration example
# Example gateway rule (Spring Cloud Gateway) restricting workflow task APIs to a role
spring:
  cloud:
    gateway:
      routes:
        - id: ruoyi-workflow-task
          uri: lb://ruoyi-workflow
          predicates:
            - Path=/task/**
          filters:
            - name: AuthorizationFilter
              args:
                requiredRoles: workflow:task:handler