This vulnerability occurs in the Workflow Endpoint of Dromara RuoYi-Vue-Plus, affecting several controller endpoints such as FlwInstanceController, FlwDefinitionController, FlwCategoryController, FlwSpelController, and TestLeaveController. The flaw allows an attacker to bypass the intended authorization checks, potentially giving them unauthorized access to workflow management functions. The description indicates the attack can originate remotely, using the exposed API endpoints to manipulate the workflow service. The weakness is identified by CWE-266 and CWE-285, which relate to improper privilege enhancement and incorrect authorization checks, respectively.

Products from Dromara: RuoYi‑Vue‑Plus versions up to and including 5.6.2 are affected. The vulnerable components are the workflow endpoint controllers listed above. No later versions are specified as affected, implying versions 5.6.3 and above are presumed safe.

With a CVSS score of 5.3, the vulnerability poses a moderate risk. No EPSS score is available, and it is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been documented. Nonetheless, the attack vector is remote, relying on access to the public API endpoints. An attacker who can reach these endpoints may exploit the authorization bypass to perform unauthorized operations within the workflow system.