6 matches found
CVE-2026-110118
WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the complete, completeTask or reAssign handle...
CVE-2026-110118
WorkFlow-Engine versions through 9.6.11 are susceptible to a missing authorization vulnerability (CWE-639) within the /vue/buttonOperation endpoints. This flaw allows low-privileged authenticated users to complete or reassign workflow tasks belonging to other users by supplying a known taskId to ...
CVE-2026-110118 WorkFlow-Engine through 9.6.11 Missing Authorization via flowableui buttonOperation Endpoints
WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the complete, completeTask or reAssign handle...
CVE-2026-110118 WorkFlow-Engine through 9.6.11 Missing Authorization via flowableui buttonOperation Endpoints
WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the complete, completeTask or reAssign handle...
PT-2026-111710
Name of the Vulnerable Software and Affected Versions WorkFlow-Engine versions prior to 9.6.12 Description Authenticated users can complete or reassign workflow tasks belonging to other users due to missing authorization. Low-privileged attackers can exploit this by providing a known taskId to th...
CVE-2026-110118: Authorization Bypass Through User-Controlled Key
WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the complete, completeTask or reAssign handle...