5.3
Medium
CVE-2026-77795 A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2
Description
A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategoryController/FlwSpelController/TestLeaveController of the component Workflow Endpoint. Such manipulation leads to improper authorization. The attack can be launched remotely.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| RuoYi-Vue-Plus 5.6 | 5.6.0 → 5.6.2 | No fix stated |
Other CVEs of RuoYi-Vue-Plus
The 6 CVEs of RuoYi-Vue-Plus →
CVE-2026-119647
RuoYi-Vue-Plus through 6.0.0 Data-Scope Bypass via /system/user/list/dept/{deptId}
5.3
Medium
CVE-2026-110106
RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated…
2.3
Low
CVE-2026-58176
RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management endpoints under /workflow/task…
6.5
Medium
CVE-2026-2819
A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.5.3
5.3
Medium