The vulnerability originates from missing permission annotations on several core task APIs in the FlwTaskController and from a Service layer that does not verify whether the current user is the task handler or a related user, allowing authenticated low‑privileged remote attackers to read sensitive workflow task details through /task/getTask/{taskId} and to trigger unauthorized workflow executions via /task/startWorkFlow.

Versions of RuoYi-Cloud-Plus up to and including 2.6.2 within the ruoyi-workflow module are vulnerable, specifically the FlwTaskController and its associated request paths.

The attack vector requires an authenticated account with low privileges but does not require escalation, as inferred from the description. Once authenticated, the attacker can read internal workflow metadata and initiate workflow instances that could alter business processes or expose confidential data. The CVSS score is 4.3, the EPSS score is less than 1%, and the vulnerability is not listed in CISA's KEV catalog. Based on the available information, the risk could be moderate due to the potential for data leakage and unauthorized process execution without privilege escalation.