CVE-2026-77795

Executive Summary

CVE-2026-77795 is an improper authorization vulnerability (CWE-266) affecting the workflow endpoint components of Dromara RuoYi-Vue-Plus versions up to and including 5.6.2. The flaw resides in multiple controller functions within the Workflow Endpoint — specifically FlwInstanceController, FlwDefinitionController, FlwCategoryController, FlwSpelController, and TestLeaveController — and allows a remote, authenticated (low-privilege) attacker to perform unauthorized actions due to missing or insufficient authorization checks. With a CVSS score of 6.3 (Medium), successful exploitation could lead to limited confidentiality, integrity, and availability impacts on the affected RuoYi-Vue-Plus instance, potentially enabling unauthorized workflow manipulation, data exposure, or service disruption. As of this writing, no patch is available, and the vulnerability remains unpatched.

Technical Analysis

RuoYi-Vue-Plus is a popular open-source Java-based rapid development platform built on Spring Boot, commonly used in enterprise environments for administrative systems, internal tools, and business management applications. The platform is derived from the widely deployed RuoYi project and includes additional features, one of which is workflow management powered by the Flowable workflow engine.

The vulnerability is categorized as CWE-266 — Incorrect Privilege Assignment. This class of vulnerability occurs when a software component performs its functions without verifying that the requesting user possesses the required privileges or permissions. The NVD description specifically identifies the following controller components within the Workflow Endpoint as affected:

• FlwInstanceController — handles workflow process instance operations (e.g., starting, querying, or terminating process instances)
• FlwDefinitionController — handles workflow process definition management (e.g., viewing, deploying, or modifying process definitions)
• FlwCategoryController — handles workflow process category management
• FlwSpelController — handles Spring Expression Language (SpEL)-related operations within the workflow context, which is particularly noteworthy given SpEL's history of injection and misconfiguration risks
• TestLeaveController — appears to be a test/demo controller for leave approval workflows, likely used in RuoYi's sample workflow configurations

The attack mechanism is an improper authorization flaw: these endpoint controllers apparently fail to enforce Role-Based Access Control (RBAC) or permission annotations that would otherwise restrict which authenticated users may invoke their methods. In typical RuoYi implementations, permission checks are enforced via annotations such as @PreAuthorize or RuoYi's custom @RequiresPermissions annotations on individual controller methods. If these annotations are missing or misconfigured on one or more methods in the affected controllers, any authenticated user — regardless of their assigned role or permission level — could invoke these workflow-related operations.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) confirms:

The presence of PR:L confirms that the attacker must possess at least a low-privilege authenticated account on the target system — this is not an unauthenticated vulnerability. This aligns with the improper authorization weakness: the flaw bypasses privilege escalation checks but does require the attacker to be an existing user of the system.

No specific technical details about the exact missing authorization mechanism, such as which HTTP methods or exact request parameters are affected, are provided in the NVD description. The description notes "insufficient technical detail available" regarding the precise implementation failure. What is known is that the affected controllers are reachable by low-privileged users, and the manipulation can occur remotely.

Exploitation Scenarios

No public exploit or PoC is currently known for CVE-2026-77795. The attack chain below is inferred from the vulnerability class (improper authorization in workflow management endpoints) and the information available in the NVD description.

Step 1: Reconnaissance / Target Identification

The attacker first identifies a target running RuoYi-Vue-Plus version 5.6.2 or earlier. Since RuoYi projects have a distinctive login page and API structure, fingerprinting can be performed using:

• Shodan or FOFA queries targeting searchable web banners (e.g., http.title:"RuoYi" or http.title:"若依")
• HTTP response headers or specific static resource paths commonly present in the RuoYi-Vue-Plus frontend

Step 2: Authentication and Access Establishment

The attacker would then need to create or compromise a low-privileged account. The PR:L component of the CVSS vector means an attacker can exploit this with just a regular, unprivileged user account (e.g., a default-created user or a poorly secured account obtained through credential brute-forcing — note the default credentials in RuoYi are commonly admin/123456 and admin/admin123, though the attacker may target a non-admin account). Alternatively, the attacker may target default demo accounts or accounts with limited permissions on an exposed deployment.

Step 3: Triggering the Authorization Bypass

After authentication, the attacker crafts HTTP requests directly to the affected controller endpoints within the Workflow Endpoint. Because the vulnerability is improper authorization in the FlwInstanceController, FlwDefinitionController, FlwCategoryController, FlwSpelController, and TestLeaveController, the attacker would:

• Enumerate the workflow-related REST endpoints (e.g., paths matching patterns like /workflow/instance/**, /workflow/definition/**, /workflow/category/**, /workflow/spel/**, and /workflow/testLeave/** — these path patterns are inferred from the controller class names and should be confirmed by testing against a live instance)
• Submit crafted HTTP requests (e.g., GET, POST, DELETE) to these endpoints that should require elevated permissions (e.g., for admin-only workflow operations)
• Observe that the server processes the request successfully and returns the expected response, demonstrating the missing authorization check

Step 4: Post-Exploitation Impact

Once the authorization bypass is confirmed, the attacker can perform a range of unauthorized operations limited by what the controllers expose:

• Process instance manipulation — viewing, starting, canceling, or modifying workflow process instances
• Process definition tampering — viewing or potentially modifying deployed workflow process definitions
• Workflow category management — altering workflow classification and organizational data
• SpEL expression execution — if the FlwSpelController exposes an expression evaluation method without proper authorization, the attacker might submit crafted SpEL expressions. While the CVSS score caps impact at Low for all three (C/I/A), SpEL injection could potentially be chained with other vulnerabilities for greater impact if input validation is also flawed
• Data exposure — leaking of workflow-related sensitive business data (e.g., approval decisions, sensitive personnel information, financial workflows)

The post-exploitation impact is classified as Low (per the CVSS sub-scores), indicating that the attacker's reach is limited to the workflow subsystem rather than a full system compromise. However, in the context of a business process management tool, compromised workflow integrity can have cascading operational consequences — approval chains can be disrupted, sensitive workflow data can be leaked, and trust in the workflow system can be undermined.

Impact Assessment

Business Impact

RuoYi-Vue-Plus is widely deployed across Chinese-speaking enterprise environments, including government agencies, state-owned enterprises, and private companies that use it as a rapid application development framework. The platform's workflow component handles critical business processes — leave approval, expense approvals, procurement workflows, compliance processes — meaning the integrity of these workflows is directly tied to organizational operational integrity.

The Medium severity (CVSS 6.3) reflects the combination of a network-exploitable flaw with low complexity, low privilege requirement, and the lack of user interaction — making it a realistic target for moderately skilled attackers who already have a foothold on a RuoYi deployment.

Operational Impact

From a SOC perspective, this vulnerability is notable because:

1. No patch is available — affected organizations cannot simply upgrade to remediate
2. The attack surface is a well-known open-source framework with a large deployment base
3. The affected controllers are exposed over the network and reachable by any authenticated user
4. The workflow component runs within the primary application server, meaning the attacker is already inside the application boundary when they exploit this flaw, making detection more challenging

Detection Guidance

Sigma Rule

title: RuoYi-Vue-Plus Workflow Endpoint Unauthorized Access Attempt
id: 2f7a8e41-3d5e-4b97-8c4d-1f9a6c3b7e92
status: experimental
description: Detects attempts to access RuoYi-Vue-Plus workflow controller endpoints that may indicate exploitation of CVE-2026-77795 (improper authorization in workflow endpoints)
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  product: ruoyi
  service: web
  category: webserver
  definition: 'Requirements: Access logs from the RuoYi-Vue-Plus application server, or a reverse proxy in front of the application'
detection:
  selection_workflow_paths:
    cs-uri-path|contains:
      - '/workflow/instance/'
      - '/workflow/def/'
      - '/workflow/definition/'
      - '/workflow/category/'
      - '/workflow/spel/'
      - '/workflow/testLeave/'
      - '/workflow/test-leave/'
  selection_low_privilege:
    - cs-username|re: '(?i)(user|member|guest|viewer|operator|staff|employee)' || cs-username|endswith: [''])
  filter_known_admin:
    cs-username|contains|all:
      - 'admin'
      - 'sysadmin'
      - 'root'
  condition: selection_workflow_paths and selection_low_privilege and not filter_known_admin
  timeframe: 15m
fields:
  - cs-username
  - c-ip
  - cs-method
  - cs-uri-path
  - sc-status
falsepositives:
  - Legitimate low-privilege users may access certain read-only workflow endpoints that are intentionally exposed (e.g., viewing their own workflow tasks)
  - Workflow endpoints may be accessed by service accounts that appear as low-privilege in logs
level: medium
tags:
  - attack.t1213
  - attack.t1068
  - cve.2026-77795
  - cwe.266

YARA Rule

/*
 * YARA rule for CVE-2026-77795
 * Targets log files and HTTP request captures containing
 * unpatched RuoYi-Vue-Plus workflow endpoint access patterns.
 */
rule RuoYi_Workflow_Auth_Bypass_CVE_2026_77795
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects strings and patterns in HTTP logs or captures indicating access to RuoYi-Vue-Plus workflow endpoints affected by CVE-2026-77795"
        date = "2026-01-01"
        cve = "CVE-2026-77795"
        cwe = "CWE-266"
        severity = "medium"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-77795"

    strings:
        // Workflow endpoint paths (inferred from controller class names in NVD description)
        $s1 = "/workflow/instance/" ascii nocase
        $s2 = "/workflow/def/" ascii nocase
        $s3 = "/workflow/definition/" ascii nocase
        $s4 = "/workflow/category/" ascii nocase
        $s5 = "/workflow/spel/" ascii nocase
        $s6 = "/workflow/testLeave/" ascii nocase
        $s7 = "FlwInstanceController" ascii
        $s8 = "FlwDefinitionController" ascii
        $s9 = "FlwCategoryController" ascii
        $s10 = "FlwSpelController" ascii
        $s11 = "TestLeaveController" ascii
        $s12 = "/workflow/test-leave/" ascii nocase

        // Version fingerprint for RuoYi-Vue-Plus - context indicators
        $v1 = "RuoYi-Vue-Plus" ascii
        $v2 = "ruoyi" ascii nocase

    condition:
        uint16(0) == 0x0A0D or uint16(0) == 0x0D0A or
        (any of ($s1, $s2, $s3, $s4, $s5, $s6, $s12) and
         (any of ($v1, $v2) or any of ($s7, $s8, $s9, $s10, $s11)))
}

Suricata IDS Rule

# Suricata rule for CVE-2026-77795 detection
# Detection of HTTP requests targeting RuoYi-Vue-Plus workflow endpoints
# that may be used to exploit improper authorization (CWE-266)

alert http any any -> $HOME_NET any (
    msg:"ET EXPLOIT RuoYi-Vue-Plus Workflow Endpoint Authorization Bypass Attempt (CVE-2026-77795)";
    flow:established,to_server;
    http.method; content:"GET"; http.method; content:"POST"; http.method; content:"PUT"; http.method; content:"DELETE";
    http.uri;
    content:"/workflow/";
    pcre:"/(?i)\/workflow\/(instance|definition|def|category|spel|testLeave|test-leave)\//";
    classtype:attempted-admin;
    sid:17977795;
    rev:1;
    metadata:created_at 2026_01_01, updated_at 2026_01_01, cve CVE-2026-77795, cwe CWE-266, attack_target Web_Server, deployment Perimeter;
)

# Alert when low-privilege source addresses access the workflow endpoints
# NOTE: Requires netflow/http logging enrichment for user identity; this rule alerts
# on the base pattern and operators should filter based on known admin IP ranges.
alert http any any -> $HOME_NET any (
    msg:"ET POLICY RuoYi-Vue-Plus Workflow Endpoint Access from Unknown Source (CVE-2026-77795 Context)";
    flow:established,to_server;
    http.uri;
    content:"/workflow/";
    pcre:"/(?i)\/workflow\/(instance|definition|def|category|spel|testLeave|test-leave)\//";
    content:"/";
    offset:0;
    depth:128;
    classtype:policy-violation;
    sid:17977796;
    rev:1;
    metadata:created_at 2026_01_01, updated_at 2026_01_01, cve CVE-2026-77795, cwe CWE-266, attack_target Web_Server, deployment DMZ;
)

Elastic Detection

// Elastic EQL rule for CVE-2026-77795 detection
// Detects HTTP access to RuoYi-Vue-Plus workflow endpoints
// by non-admin or unprivileged source accounts

sequence by source.ip with maxspan=5m
  [ network where
      network.direction == "ingress" and
      network.protocol == "http" and
      destination.port in (80, 443, 8080, 8443) and
      url.path like~ "*workflow/instance*" or
      url.path like~ "*workflow/definition*" or
      url.path like~ "*workflow/def*" or
      url.path like~ "*workflow/category*" or
      url.path like~ "*workflow/spel*" or
      url.path like~ "*workflow/testLeave*" or
      url.path like~ "*workflow/test-leave*"
  ] by source.ip
  [ authentication where
      event.category == "authentication" and
      event.outcome == "success" and
      (user.name like~ "user*" or user.name like~ "member*" or user.name like~ "viewer*" or user.name like~ "guest*" or user.name like~ "operator*") and
      not user.name like~ "admin*"
  ] by user.name

// Additional correlation: flag if the same source IP accesses
// multiple different workflow endpoints in rapid succession
sequence by source.ip with maxspan=2m
  [ network where network.direction == "ingress" and network.protocol == "http" and url.path like~ "*workflow/instance*" ]
  [ network where network.direction == "ingress" and network.protocol == "http" and url.path like~ "*workflow/definition*" ]
  [ network where network.direction == "ingress" and network.protocol == "http" and url.path like~ "*workflow/spel*" ]

Splunk SPL Query

# Splunk SPL for CVE-2026-77795 detection
# Requirements: Splunk ingesting access logs from a reverse proxy or app server
# Adjust sourcetype/index names as appropriate

index=web sourcetype=access_combined 
  (uri_path="/workflow/instance/*" OR uri_path="/workflow/definition/*" OR uri_path="/workflow/def/*" OR uri_path="/workflow/category/*" OR uri_path="/workflow/spel/*" OR uri_path="/workflow/testLeave/*" OR uri_path="/workflow/test-leave/*")
  [ search index=web sourcetype=access_combined user!="admin*" user!="sysadmin*" | fields user | dedup user ]
| stats count, values(uri_path) as urls, values(src_ip) as src_ips, earliest(_time) as first_seen, latest(_time) as last_seen by user
| where count >= 1
| eval vuln_indicators=if(match(user, "(?i)user|member|guest|viewer|operator|staff"), "LOW_PRIV_USER", "UNKNOWN_PRIV")
| table _time, user, vuln_indicators, urls, src_ips, count
| sort - _time

# Alternative alerting query: any access to workflow endpoints from non-allowlisted networks
index=web sourcetype=access_combined 
  (uri_path="/workflow/instance/*" OR uri_path="/workflow/definition/*" OR uri_path="/workflow/def/*" OR uri_path="/workflow/category/*" OR uri_path="/workflow/spel/*" OR uri_path="/workflow/testLeave/*" OR uri_path="/workflow/test-leave/*")
  NOT (src_ip IN (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16))
  NOT (user="admin" OR user="sysadmin")
| stats count by src_ip, user, uri_path, http_method
| where count > 5

Wazuh OSSEC Rule

<!--
  Wazuh OSSEC rule for CVE-2026-77795
  Detects HTTP access to RuoYi-Vue-Plus workflow endpoints (Authorization bypass context)
  Place in /var/ossec/etc/rules/local_rules.xml
-->
<group name="web,app,ruoyi,">

  <!-- Rule: Workflow endpoint accessed by non-admin user -->
  <rule id="190001" level="8">
    <decoded_as>web</decoded_as>
    <description>RuoYi-Vue-Plus workflow endpoint access (CVE-2026-77795) — potential unauthorized authorization bypass</description>
    <match>//workflow/</match>
    <regex>\/workflow\/(instance|definition|def|category|spel|testLeave|test-leave)\/</regex>
    <group>ruoyi_workflow_authbypass,cve_2026_77795,attack.t1213,</group>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>

  <!-- Rule: Multiple distinct workflow endpoints accessed by same source in short time -->
  <rule id="190002" level="12" frequency="8" timeframe="120">
    <if_matched_sid>190001</if_matched_sid>
    <same_source_ip/>
    <description>RuoYi-Vue-Plus — repeated workflow endpoint access indicates active enumeration of authorization bypass (CVE-2026-77795)</description>
    <group>ruoyi_workflow_authbypass,cve_2026_77795,extreme_enumeration,</group>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>

  <!-- Rule: Workflow endpoint accessed with success status by known low-privilege user file -->
  <rule id="190003" level="10" frequency="3" timeframe="60">
    <if_matched_sid>190001</if_matched_sid>
    <field name="url">\.php|\.jsp|\.do|action</field>
    <description>RuoYi-Vue-Plus — possible brute-force attempt of workflow endpoints (CVE-2026-77795)</description>
    <group>ruoyi_workflow_authbypass,cve_2026_77795,bruteforce,</group>
  </rule>

</group>

Mitigation & Patch Guidance

Patch Status

PATCH CONFIDENCE: 0/4 — UNPATCHED

No patch evidence exists from any tracked source as of the publication of this report. The CVE has no associated vendor advisory referencing a fix, no verified version number beyond 5.6.2 is listed as vulnerable, and no patch or commit has been identified. The Affected Versions field in the CVE data is empty, meaning even the exact scope of affected versions remains unclear beyond the indication "up to 5.6.2" in the NVD description.

Organizations running RuoYi-Vue-Plus must assume they are vulnerable until a patch is officially released by the Dromara project.

Immediate Mitigations (No Patch Available)

1. Restrict network access to the Workflow Endpoint: If the workflow functionality is not required for all user groups, place the application behind an authentication reverse proxy that enforces network-level access control. Implement IP allowlisting to restrict access to known internal IP ranges.
2. Disable or block the affected controllers: If the codebase is accessible, consider removing or disabling the FlwSpelController and TestLeaveController entirely — test controllers are rarely needed in production. For the other controllers, verify whether any controller methods lack the standard @RequiresPermissions or @PreAuthorize annotations and add them.
3. Deploy a WAF rule: Configure a Web Application Firewall (WAF) to block requests to /workflow/ paths from non-admin source IP ranges, and alert on any successful authentication from low-privilege accounts followed by workflow endpoint requests.
4. Apply restrictive session and RBAC policies: Ensure that all user accounts have the least-privilege model enforced; audit current user permissions and disable any default demo accounts (e.g., test users, test accounts associated with TestLeaveController).
5. Monitor workflow-related audit logs: Enable comprehensive audit logging for all workflow operations, specifically tracking which users invoke workflow controller methods and correlating those with user permission levels.

Patch/Upgrade Steps

1. Monitor vendor advisory channels: Track the Dromara RuoYi-Vue-Plus official repository (Gitee/GitHub) for release notes and patch announcements. The fix is expected to arrive as a version bump beyond 5.6.2.
2. Prepare upgrade path: Maintain a staging environment that mirrors the production RuoYi-Vue-Plus deployment. When a patch is released, test the upgrade in staging first, with particular focus on workflow functionality regression testing.
3. Backup before upgrade: Take full database and application backups before applying any patch or upgrade.
4. Downgrade strategy: If patching breaks existing workflow definitions, have a rollback plan to restore the previous version while maintaining mitigation controls.

Long-Term Hardening

1. Harden RuoYi-Vue-Plus default configuration: Review the application.yml and security configuration for any permissive defaults. Disable unnecessary workflow modules and endpoints as per business requirements.
2. RBAC audit: Perform a comprehensive review of all role-to-permission mappings in the RuoYi platform. Ensure every controller method is protected by an appropriate @RequiresPermissions or equivalent annotation — this is the root cause of CWE-266 style issues.
3. Deploy formal change management: Implement a change advisory process for all RuoYi-Vue-Plus code changes, insuring security code reviews are performed for any custom controller implementations.
4. Application hardening: Run the application under a non-root service account, use a dedicated database account with least-privilege DB permissions, and deploy the application in a containerized environment with a read-only root filesystem where possible.
5. Vulnerability management integration: Add RuoYi-Vue-Plus to an ongoing vulnerability scanning program. Subscribed to security advisories for the project; enable automated updates once patched versions are available.
6. Network segmentation: Isolate RuoYi-Vue-Plus deployments behind an internal network segment, avoiding direct internet exposure. If remote access is required, enforce a VPN or jump-host architecture.

References

1. NVD Entry: CVE-2026-77795 — https://nvd.nist.gov/vuln/detail/CVE-2026-77795 (official NVD record, CVSS vector, CWE classification)
2. Dromara RuoYi-Vue-Plus Repository: https://gitee.com/dromara/RuoYi-Vue-Plus (official project repository — monitor for patch releases and security advisories)
3. RuoYi-Vue-Plus GitHub Mirror: https://github.com/dromara/RuoYi-Vue-Plus (upstream mirror for issue tracking and release history)
4. CWE-266 Reference: https://cwe.mitre.org/data/definitions/266.html (MITRE official description of Incorrect Privilege Assignment)
5. ATT&CK T1213 — Exploit Data from Information Repositories: https://attack.mitre.org/techniques/T1213/ (MITRE ATT&CK technique reference for workflow/data repository exploitation)

Threat Actor Confidence & Exploit-in-the-Wild Status

• CISA KEV: NO — not listed on CISA's Known Exploited Vulnerabilities catalog
• Exploit-in-the-Wild evidence: NONE — no public reports of real-world exploitation as of this writing
• PoC availability: UNKNOWN — no public proof-of-concept code has been released
• Nuclei template: NO — no Nuclei detection template has been published for this CVE
• Known threat actor campaigns: NONE — no specific threat actor has been publicly attributed to targeting this vulnerability

Organizations should remain vigilant, as the absence of a patch and the public nature of the vulnerable codebase create an attractive target for opportunistic attackers once a working exploit is demonstrated. The Dromara ecosystem's large deployment base makes CVE-2026-77795 a candidate for future weaponized exploitation, particularly in targeted attacks against organizations using RuoYi-based systems for internal administration.