CVE-2026-2819

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2819", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-19T17:12:58.633Z", "datePublished": "2026-02-20T01:32:06.214Z", "dateUpdated": "2026-02-23T19:00:57.578Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T10:29:51.667Z"}, "title": "Dromara RuoYi-Vue-Plus Workflow deleteByInstanceIds SaServletFilter authorization", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-862", "lang": "en", "description": "Missing Authorization"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-863", "lang": "en", "description": "Incorrect Authorization"}]}], "affected": [{"vendor": "Dromara", "product": "RuoYi-Vue-Plus", "versions": [{"version": "5.5.0", "status": "affected"}, {"version": "5.5.1", "status": "affected"}, {"version": "5.5.2", "status": "affected"}, {"version": "5.5.3", "status": "affected"}], "cpes": ["cpe:2.3:a:dromara:ruoyi-vue-plus:*:*:*:*:*:*:*:*"], "modules": ["Workflow Module"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.5.3. This vulnerability affects the function SaServletFilter of the file /workflow/instance/deleteByInstanceIds of the component Workflow Module. The manipulation leads to missing authorization. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-02-19T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-02-19T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-02-22T07:44:52.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "feng123123 (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.346944", "name": "VDB-346944 | Dromara RuoYi-Vue-Plus Workflow deleteByInstanceIds SaServletFilter authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.346944", "name": "VDB-346944 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.753321", "name": "Submit #753321 | Dromara RuoYi-Vue-Plus 5.5.3 Privilege Escalation", "tags": ["third-party-advisory"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-23T19:00:43.722153Z", "id": "CVE-2026-2819", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T19:00:57.578Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2819", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-23T19:00:43.722153Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T19:00:52.920Z"}}], "cna": {"title": "Dromara RuoYi-Vue-Plus Workflow deleteByInstanceIds SaServletFilter authorization", "credits": [{"lang": "en", "type": "reporter", "value": "feng123123 (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:dromara:ruoyi-vue-plus:*:*:*:*:*:*:*:*"], "vendor": "Dromara", "modules": ["Workflow Module"], "product": "RuoYi-Vue-Plus", "versions": [{"status": "affected", "version": "5.5.0"}, {"status": "affected", "version": "5.5.1"}, {"status": "affected", "version": "5.5.2"}, {"status": "affected", "version": "5.5.3"}]}], "timeline": [{"lang": "en", "time": "2026-02-19T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-02-19T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-02-22T07:44:52.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.346944", "name": "VDB-346944 | Dromara RuoYi-Vue-Plus Workflow deleteByInstanceIds SaServletFilter authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.346944", "name": "VDB-346944 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.753321", "name": "Submit #753321 | Dromara RuoYi-Vue-Plus 5.5.3 Privilege Escalation", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.5.3. This vulnerability affects the function SaServletFilter of the file /workflow/instance/deleteByInstanceIds of the component Workflow Module. The manipulation leads to missing authorization. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "Incorrect Authorization"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T10:29:51.667Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2819", "state": "PUBLISHED", "dateUpdated": "2026-02-23T19:00:57.578Z", "dateReserved": "2026-02-19T17:12:58.633Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-02-20T01:32:06.214Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:dromara:ruoyi-vue-plus:*:*:*:*:*:*:*:*"], "modules": ["Workflow Module"], "product": "RuoYi-Vue-Plus", "vendor": "Dromara", "versions": [{"status": "affected", "version": "5.5.0"}, {"status": "affected", "version": "5.5.1"}, {"status": "affected", "version": "5.5.2"}, {"status": "affected", "version": "5.5.3"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.5.3. This vulnerability affects the function SaServletFilter of the file /workflow/instance/deleteByInstanceIds of the component Workflow Module. The manipulation leads to missing authorization. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en Dromara RuoYi-Vue-Plus hasta 5.5.3. Esta vulnerabilidad afecta la funci\u00f3n SaServletFilter del archivo /workflow/instance/deleteByInstanceIds del componente M\u00f3dulo de Flujo de Trabajo. Si se manipula se logra una falta de autorizaci\u00f3n. El ataque puede ser iniciado en remoto. El exploit est\u00e1 disponible p\u00fablicamente y podr\u00eda ser utilizado. Se avis\u00f3 pronto al proveedor sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-2819", "lastModified": "2026-06-17T10:31:49.793", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2819", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-23T19:00:43.722153Z", "version": "2.0.3"}}]}, "published": "2026-02-20T02:16:55.350", "references": [{"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.346944"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.346944"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.753321"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}, {"lang": "en", "value": "CWE-863"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.5.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.5.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.5.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.5.3"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "RuoYi-Vue-Plus", "source": "cna", "vendor": "Dromara"}, "product": "ruoyi-vue-plus", "vendor": "dromara"}], "analysis": {"en": {"generated_at": "2026-04-17T17:34:14.115625+00:00", "value": {"mitigation_remediation": ["Apply the latest patch or upgrade RuoYi\u2011Vue\u2011Plus to a version newer than 5.5.3 when available.", "If an upgrade is not possible, restrict access to the /workflow/instance/deleteByInstanceIds endpoint with network firewall rules or application\u2011level authorization policies to block unauthorized users.", "Monitor system logs for attempts to delete workflow instances and investigate any unauthorized deletions."], "summary": {"action": "Apply Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "Affected products are the Dromara RuoYi\u2011Vue\u2011Plus workflow module up to version 5.5.3. Any deployment of this software that relies on the SaServletFilter for the /workflow/instance/deleteByInstanceIds endpoint is impacted. No other versions have been confirmed as affected.", "description_and_impact": "The vulnerability resides in the SaServletFilter component of the Workflow Module; by manipulating the /workflow/instance/deleteByInstanceIds endpoint an attacker can bypass authorization and delete workflow instances without permission, potentially causing data loss and business process disruption. The flaw is a broken access control deficiency (CWE\u2011862) and other access control issue (CWE\u2011863).", "risk_and_exploitability": "CVSS score 5.3 indicates moderate severity; EPSS <1% suggests very low current exploitation probability, and the vulnerability is not listed in CISA\u2019s KEV catalog. However, the exploit is publicly available and can be triggered remotely through standard HTTP requests. Lack of an official fix means the risk remains until a vendor patch or a workaround is applied."}}}}, "created": "2026-02-20T09:52:58.648939+00:00", "updated": "2026-04-17T17:45:24.338983+00:00", "vendors": ["dromara", "dromara$PRODUCT$ruoyi-vue-plus"]}