CVE-2026-110118

WorkFlow-Engine versions through 9.6.11 are susceptible to a missing authorization vulnerability (CWE-639) within the /vue/buttonOperation endpoints. This flaw allows low-privileged authenticated users to complete or reassign workflow tasks belonging to other users by supplying a known taskId to ...