Missing authorization in WorkFlow-Engine task buttonOperation endpoints
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
WorkFlow-Engine through 9.6.11 from risesoft-y9 has a missing authorization flaw that lets authenticated users complete or reassign other users' workflow tasks through the /vue/buttonOperation endpoints. This is tracked as CWE-639, authorization bypass through a user-controlled key. A low-privileged attacker who knows a taskId can approve or reassign tasks without authority, and the flaw affects integrity only.
Written with Claude Haiku 5.5 from the sources below · 2026-10-27
Description from the CNA
WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the complete, completeTask or reAssign handlers to approve tasks or reassign them without authority.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| risesoft-y9 | WorkFlow-Engine | up to 9.6.11 | — | No fix listed | CNA |
- WorkFlow-Engine Vendorrisesoft-y9 Affected up to 9.6.11 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for WorkFlow-Engine.
Written with Claude Haiku 5.5 from the sources below · 2026-10-27
Timeline
- 2026-10-13 Threatist record created from CVE-2026-110118
- 2026-10-13 Alias added: GHSA-j9qx-hx2v-8q9m
- 2026-10-14 Priority changed: MEDIUM → LOW
- 2026-10-18 CISA SSVC decision points changed
References
Other 3
- https://github.com/risesoft-y9/WorkFlow-Engine/blob/v9.6.11/y9-module-flowableui/risenet-y9boot-support-flowableui/src/main/java/net/risesoft/controller/buttonOperation/ButtonOperationRestController.java#L1035-L1054
- https://github.com/risesoft-y9/WorkFlow-Engine/blob/v9.6.11/y9-module-flowableui/risenet-y9boot-support-flowableui/src/main/java/net/risesoft/controller/buttonOperation/ButtonOperationRestController.java#L216-L252
- https://github.com/risesoft-y9/WorkFlow-Engine/blob/v9.6.11/y9-module-processadmin/risenet-y9boot-support-processadmin/src/main/java/net/risesoft/service/impl/CustomTaskServiceImpl.java#L76-L79
More risesoft-y9 vulnerabilities
- TI-2026-65446 risesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injection CVSS 4.0MEDIUM 6.9
- TI-2026-00785 risesoft-y9 Digital-Infrastructure REST Authenticate Endpoint Y9PlatformUtil.java sql injection CVSS 4.0MEDIUM 6.9
- TI-2025-06470 risesoft-y9 Digital-Infrastructure Y9FileController.java deleteFile path traversal CVSS 4.0MEDIUM 5.3
- TI-2026-72000 Path traversal in Risesoft-y9 Digital-Infrastructure lets attackers write files CVSS 4.0HIGH 8.8
- TI-2026-71999 Path traversal in Risesoft Digital-Infrastructure file retrieval CVSS 4.0HIGH 8.7
- TI-2026-75437 Risesoft Digital-Infrastructure exposes other tenants' personnel data CVSS 4.0HIGH 7.1
Sources
- CVE-2026-110118 · CVE Program
- CVE-2026-110118 · NVD
- FIRST EPSS
- GHSA-j9qx-hx2v-8q9m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences