CVE Intelligence

Vulnerabilidades do Risesoft-y9 WorkFlow-Engine

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Risesoft-y9 WorkFlow-Engine: 1 registro(s), com versões afetadas e correções.

CVE-2026-110118 Média · 6.5 CWE-639 13/10/2026
WorkFlow-Engine through 9.6.11 Missing Authorization via flowableui buttonOperation Endpoints
WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the complete, completeTask or reAssign handlers to approve tasks or reassign them without authority.