Read the docs
TI-2026-42058 Aliases CVE-2026-58448GHSA-f6rh-2m88-w48m

yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API

Priority MEDIUM 64CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

yudao-cloud before 2026.06 contains a broken access control vulnerability in the BPM module that allows any authenticated user to access arbitrary process instance records by supplying a caller-controlled process-instance identifier to an unprotected endpoint lacking the @PreAuthorize annotation. Attackers can query any process-instance identifier through the unguarded GET endpoint to read sensitive workflow data including submitted form variables, approver identities, approval and rejection comments, and process BPMN XML without ownership or tenant party verification.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00402 34th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed yudao-cloud (YunaiV): 2026.06

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
YunaiVyudao-cloudbefore 2026.062026.06Patch availableCNA
  • yudao-cloud VendorYunaiV Affected before 2026.06 Fixed in 2026.06 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:iocoder:yudao-cloud:*:*:*:*:*:*:*:*——YunaiV
  • cpe:2.3:a:iocoder:yudao-cloud:*:*:*:*:*:*:*:* Versions — — ·YunaiV

Remediation

  • Fix · CNA yudao-cloud (YunaiV) Fixed in 2026.06

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-58448
  2. 2026-10-03 Alias added: GHSA-f6rh-2m88-w48m

References

Exploit 1

Patch 1

  • TI-2026-80126 Improper authentication in YunaiV ruoyi-vue-pro SMS code verification CVSS 4.0MEDIUM 6.9
  • TI-2026-11453 Path traversal in YunaiV ruoyi-vue-pro CVSS 4.0MEDIUM 6.9
  • TI-2026-06792 YunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication CVSS 4.0MEDIUM 6.9
  • TI-2026-04492 YunaiV yudao-cloud get-by-website sql injection CVSS 4.0MEDIUM 6.9
  • TI-2026-80085 Authorization bypass in yudao-cloud lets users evade data scope CVSS 4.0HIGH 7.1
  • TI-2026-06761 YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication CVSS 4.0MEDIUM 6.9
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences