Description
WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the complete, completeTask or reAssign handlers to approve tasks or reassign them without authority.
Published: 2026-10-13
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Missing Authorization on workflow task completion endpoints
Action: Apply Patch
AI Analysis

Impact

The exposed buttonOperation REST endpoints in WorkFlow-Engine 9.6.11 lack proper authorization checks. An authenticated user with low privileges can supply a task ID to complete, completeTask, or reAssign handlers, enabling them to approve or reassign other users' tasks without authority. This flaw allows unauthorized modification of business workflows, potentially compromising the integrity of organizational processes.

Affected Systems

The vulnerability affects the WorkFlow-Engine product from risesoft-y9, version 9.6.11. All deployments of this version are potentially impacted until the issue is remediated.

Risk and Exploitability

The CVSS score of 7.1 indicates a medium to high severity. Because the flaw is exploitable only by authenticated users, the attack vector is indirect and requires valid credentials. The EPSS score is currently unavailable, and the vulnerability is not listed as a known exploited vulnerability in KEV. Nonetheless, the absence of authorization checks poses a significant risk to workflow integrity and should be mitigated promptly.

Generated by OpenCVE AI on October 13, 2026 at 19:05 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade WorkFlow-Engine to a version that corrects the missing authorization checks on the buttonOperation endpoints.
  • Constrain access to the /vue/buttonOperation REST endpoints to users with the appropriate workflow‑management roles, ensuring that only authorized personnel can invoke complete or reassign actions.
  • Add runtime validation to verify that the task owner or an authorised user is performing completion or reassignment, and log any unauthorized attempts for audit purposes.

Generated by OpenCVE AI on October 13, 2026 at 19:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Risesoft-y9
Risesoft-y9 workflow-engine
Vendors & Products Risesoft-y9
Risesoft-y9 workflow-engine

Tue, 13 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the complete, completeTask or reAssign handlers to approve tasks or reassign them without authority.
Title WorkFlow-Engine through 9.6.11 Missing Authorization via flowableui buttonOperation Endpoints
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Risesoft-y9 Workflow-engine
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-16T22:18:12.566Z

Reserved: 2026-10-13T16:23:07.760Z

Link: CVE-2026-110118

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-13T17:17:36.130

Modified: 2026-10-16T23:16:59.303

Link: CVE-2026-110118

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T19:15:08Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key