CVE-2026-88616

CVE-2026-88616 is an incorrect authorization flaw (CWE-863) in RuoYi-Vue-Plus 6.0.0, a popular open-source Java/Spring Boot rapid-development platform. The flaw is reached through the workflow module: a call chain starting at POST /workflow/task/completeTask (FlwTaskController.java) flows through FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process, and the bundled Warm-Flow engine's TaskService.skip, ultimately allowing arbitrary code execution. Because the CVSS 3.1 vector specifies low privileges required (PR:L), any authenticated low-privilege user of an affected deployment — not just workflow administrators — can trigger the flaw over the network and gain code execution with the application's privileges, compromising confidentiality, integrity, and availability. Affected parties are organizations running RuoYi-Vue-Plus 6.0.0, which is widely used for internal enterprise admin/portal systems, particularly in China. As of this analysis, the issue is not in the CISA KEV catalog, no public proof-of-concept is known, and no exploitation has been observed in the wild.

What to do: Upgrade RuoYi-Vue-Plus 6.0.0 to the latest upstream release containing a fix for the completeTask/Warm-Flow skip authorization flaw, or apply the project's official patch if a hotfix is published. Restrict access to /workflow/task/completeTask (and the workflow module generally) to strictly vetted, least-privilege roles, and keep admin consoles off the public internet behind VPN/segmentation. Review server and application logs for unusual POST requests to /workflow/task/completeTask from low-privilege accounts and for signs of unexpected child-process or script execution under the application user.