CVE-2026-77795

CVE-2026-77795 patches an improper authorization flaw across five workflow controllers in RuoYi-Vue-Plus—FlwInstanceController, FlwDefinitionController, FlwCategoryController, FlwSpelController, and TestLeaveController. Version 5.6.2 is the patched release. The breadth of this failure should concern you more than the CVSS 6.3 rating suggests. The five-controller pattern is almost certainly not five independent coding mistakes. It reflects either a shared code skeleton or code generation artifact that was replicated without security review, a misapplied security filter that covers adjacent endpoints but excludes these five, or an assumption that workflow endpoints inherit protection from elsewhere in the stack when they don't. When you examine the patch, ask whether the vendor added endpoint-level checks to each controller individually, or whether they introduced a security interceptor that fires before any workflow controller executes. The former is a symptom fix; the latter addresses the architectural gap. If you can't determine this from the patch artifacts, treat the residual risk as higher rather than lower. The TestLeaveController name warrants specific attention. This endpoint may be a development artifact that leaked into production, or a test controller that should have been removed before release. Either possibility represents a governance failure layered on top of the authorization flaw—not just missing security checks, but endpoints that should never have reached production environments. Beyond the technical fix, consider the business impact. Workflow engines encode approval chains, escalation paths, and role-based transitions. An improper authorization flaw here doesn't just expose data—it allows an authenticated attacker to manipulate process state, skip approval stages, reorder transitions, or alter business logic in ways the workflow designer never intended. CVSS measures confidentiality, integrity, and availability in data terms; it has no vocabulary for business process integrity violation. If your deployment runs critical approval workflows, the effective severity exceeds what the 6.3 rating captures. You should also examine your audit logs for the exposure window. A sophisticated attacker exploiting this flaw wouldn't need to modify data—they'd manipulate workflow state through legitimate-seeming transitions, leaving audit records that appear correct but reflect an altered business process. Traditional forensics won't distinguish this from normal operations.

Reviewed through automated stages and approved by a human before publication.