The vulnerability resides in the GET /workflow/search endpoint of ruoyi-ai, which lacks proper authorization checks and allows authenticated non-admin users to retrieve other users’ private workflow data, including UUIDs and full node and edge configurations. Without owner or is_public filtering, the endpoint exposes sensitive workflow information and can be used to reconstruct complete private workflows. This flaw can compromise confidentiality by enabling data leakage of workflow definitions within the same tenant.

The affected product is Ageerle’s ruoyi-ai. All releases from version 3.0.0 up to and including 3.1.0 are vulnerable. The CNAs identify this vulnerability in the ruoyi-ai module supplied by ageerle for the pandarobot package.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available, which suggests no publicly documented exploitation activity. The vulnerability is not listed in the CISA KEV catalog. An attacker must be an authenticated user without administrative privileges to exploit this flaw. Because the endpoint is authenticated but does not enforce ownership checks, compromising an account or using any valid credential within the tenant suffices to exploit the missing authorization and enumerate private workflows.