The vulnerability originates from missing permission annotations on several core task APIs in the FlwTaskController and from a Service layer that does not verify whether the current user is the task handler or a related user, allowing authenticated low-privileged remote attackers to read sensitive workflow task details through /task/getTask/{taskId} and to trigger unauthorized workflow executions via /task/startWorkFlow.

Versions of RuoYi-Cloud-Plus up to and including 2.6.2 within the ruoyi-workflow module are affected; all deployments that expose the FlwTaskController and its associated request paths are vulnerable.

The attack vector requires an authenticated account with low privileges but does not require escalation; this is inferred from the description. Once authenticated, the attacker can read internal workflow metadata and initiate workflow instances that could alter business processes or expose confidential data. No public CVSS score is provided in the advisory, the EPSS is not available, and the KEV catalog does not list this vulnerability. Based on the available information, it is inferred that the risk could be moderate to high due to the potential for data leakage and unauthorized process execution without privilege escalation.