CVE-2026-77795 Overview
CVE-2026-77795 is an improper authorization vulnerability [CWE-266] affecting Dromara RuoYi-Vue-Plus versions up to 5.6.2. The flaw resides in the Workflow Endpoint component, specifically in the FlwInstanceController, FlwDefinitionController, FlwCategoryController, FlwSpelController, and TestLeaveController functions. Authenticated remote attackers can manipulate these endpoints to perform actions outside their intended authorization scope. The vulnerability affects the confidentiality, integrity, and availability of workflow data at a limited level.
Critical Impact
Remote authenticated attackers can invoke privileged workflow operations without proper authorization checks, enabling access to workflow definitions, instances, and categories intended for other users.
Affected Products
- Dromara RuoYi-Vue-Plus versions up to and including 5.6.2
- Workflow module (FlwInstanceController, FlwDefinitionController)
- Workflow subcomponents (FlwCategoryController, FlwSpelController, TestLeaveController)
Discovery Timeline
- 2026-08-21 - CVE-2026-77795 published to NVD
- 2026-08-24 - Last updated in NVD database
Technical Details for CVE-2026-77795
Vulnerability Analysis
The vulnerability stems from missing or insufficient authorization checks in multiple Spring MVC controllers within the RuoYi-Vue-Plus workflow module. Any authenticated user with low privileges can invoke sensitive endpoints exposed by FlwInstanceController, FlwDefinitionController, FlwCategoryController, FlwSpelController, and TestLeaveController. The controllers enforce authentication but fail to validate whether the calling user holds the required role or resource ownership for the requested action. This authorization gap allows horizontal and vertical privilege escalation within the workflow subsystem.
Root Cause
The root cause is an improper authorization weakness [CWE-266] where controller methods lack role-based access control annotations or resource-level ownership checks. The workflow endpoints trust authenticated session context without verifying that the principal has permission to read, modify, or execute the targeted workflow object. This design deviates from least-privilege principles and exposes administrative workflow operations to standard users.
Attack Vector
Exploitation requires network access and valid low-privileged credentials. An attacker authenticates to the RuoYi-Vue-Plus application, then issues crafted HTTP requests directly to the vulnerable controller endpoints. Because authorization is not enforced per-action, the server executes the request and returns or modifies workflow data belonging to other tenants or administrative scopes. No user interaction is required beyond the initial authentication.
No public proof-of-concept code has been verified. Refer to the GitHub Issue Discussion and the VulDB Vulnerability Details for technical write-ups.
Detection Methods for CVE-2026-77795
Indicators of Compromise
- Unexpected HTTP requests from low-privileged user sessions to /workflow/instance/**, /workflow/definition/**, /workflow/category/**, or /workflow/spel/** paths.
- Application logs showing successful workflow modifications initiated by accounts that do not own the workflow resource.
- Access to TestLeaveController endpoints from production user accounts, indicating exposure of test scaffolding.
Detection Strategies
- Correlate authenticated session identifiers with the role assigned to each user and flag calls to workflow controllers from users lacking the workflow administrator role.
- Deploy application-layer rules that inspect controller path patterns and cross-reference them against role entitlements stored in the RuoYi permission tables.
- Baseline normal workflow API usage per role and alert on statistical anomalies such as sudden spikes in FlwDefinitionController calls.
Monitoring Recommendations
- Enable verbose access logging on the Spring Boot application and forward logs to a centralized platform for retention and query.
- Monitor for HTTP 200 responses on workflow endpoints paired with non-administrative user identifiers in the same request.
- Track authorization decision outcomes if using Spring Security expression evaluation, and alert when denied decisions are absent from sensitive endpoints.
How to Mitigate CVE-2026-77795
Immediate Actions Required
- Restrict network exposure of the RuoYi-Vue-Plus workflow endpoints to trusted internal networks until a patched version is available.
- Audit user role assignments and revoke workflow permissions from accounts that do not require them.
- Disable or remove the TestLeaveController endpoint from production deployments, as it appears to be test scaffolding.
Patch Information
At the time of publication, no vendor patch has been referenced in the NVD entry for versions above 5.6.2. Monitor the Dromara RuoYi-Vue-Plus repository and the VulDB CVE Record for updated fix information. Once a fixed release is published, upgrade all instances to the patched version.
Workarounds
- Add Spring Security @PreAuthorize annotations or equivalent method-level authorization checks to each vulnerable controller method before recompilation.
- Place a reverse proxy or web application firewall in front of the application to enforce role-to-path mapping for /workflow/** endpoints.
- Segregate workflow administrator accounts from standard user accounts and require multi-factor authentication for privileged sessions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
