CVE-2026-58448

yudao-cloud before 2026.06 contains a broken access control vulnerability in the BPM module that allows any authenticated user to access arbitrary process instance records by supplying a caller-controlled process-instance identifier to an unprotected endpoint lacking the @PreAuthorize annotation. Attackers can query any process-instance identifier through the unguarded GET endpoint to read sensitive workflow data including submitted form variables, approver identities, approval and rejection comments, and process BPMN XML without ownership or tenant party verification.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/YunaiV/yudao-cloud/issues/315
https://github.com/YunaiV/yudao-cloud/releases#release-v2026.06(jdk8/11)
https://www.vulncheck.com/advisories/yudao-cloud-bpm-module-broken-access-control-via-process-instance-api

Configurations

No configuration.

History

25 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) yudao-cloud anterior a 2026.06 contiene una vulnerabilidad de control de acceso roto en el módulo BPM que permite a cualquier usuario autenticado acceder a registros arbitrarios de instancias de proceso al proporcionar un identificador de instancia de proceso controlado por el llamador a un endpoint desprotegido que carece de la anotación @PreAuthorize. Los atacantes pueden consultar cualquier identificador de instancia de proceso a través del endpoint GET desprotegido para leer datos sensibles del flujo de trabajo, incluyendo variables de formulario enviadas, identidades de los aprobadores, comentarios de aprobación y rechazo, y el XML BPMN del proceso sin verificación de propiedad o de la parte del inquilino.

Information

Published : 2026-06-30 22:16

Updated : 2026-10-25 21:10

NVD link : CVE-2026-58448

Mitre link : CVE-2026-58448

CVE.ORG link : CVE-2026-58448

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-58448", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58448", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-01T14:53:01.049235Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/YunaiV/yudao-cloud", "vendor": "YunaiV", "product": "yudao-cloud", "versions": [{"status": "affected", "version": "0", "lessThan": "2026.06", "versionType": "custom"}], "packageURL": "pkg:github/YunaiV/yudao-cloud", "defaultStatus": "unaffected"}]}], "published": "2026-06-30T22:16:58.240", "references": [{"url": "https://github.com/YunaiV/yudao-cloud/issues/315", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/YunaiV/yudao-cloud/releases#release-v2026.06(jdk8/11)", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/yudao-cloud-bpm-module-broken-access-control-via-process-instance-api", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "yudao-cloud before 2026.06 contains a broken access control vulnerability in the BPM module that allows any authenticated user to access arbitrary process instance records by supplying a caller-controlled process-instance identifier to an unprotected endpoint lacking the @PreAuthorize annotation. Attackers can query any process-instance identifier through the unguarded GET endpoint to read sensitive workflow data including submitted form variables, approver identities, approval and rejection comments, and process BPMN XML without ownership or tenant party verification."}, {"lang": "es", "value": "yudao-cloud anterior a 2026.06 contiene una vulnerabilidad de control de acceso roto en el m\u00f3dulo BPM que permite a cualquier usuario autenticado acceder a registros arbitrarios de instancias de proceso al proporcionar un identificador de instancia de proceso controlado por el llamador a un endpoint desprotegido que carece de la anotaci\u00f3n @PreAuthorize. Los atacantes pueden consultar cualquier identificador de instancia de proceso a trav\u00e9s del endpoint GET desprotegido para leer datos sensibles del flujo de trabajo, incluyendo variables de formulario enviadas, identidades de los aprobadores, comentarios de aprobaci\u00f3n y rechazo, y el XML BPMN del proceso sin verificaci\u00f3n de propiedad o de la parte del inquilino."}], "lastModified": "2026-10-25T21:10:00.770", "sourceIdentifier": "disclosure@vulncheck.com"}