CVE-2026-58448: high-severity vulnerability in YunaiV yudao-cloud
yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API
Published · Updated
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 7.1epss 0.4%
exploitation probability
0.4%top 68% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
yudao-cloud before 2026.06 contains a broken access control vulnerability in the BPM module that allows any authenticated user to access arbitrary process instance records by supplying a caller-controlled process-instance identifier to an unprotected endpoint lacking the @PreAuthorize annotation. Attackers can query any process-instance identifier through the unguarded GET endpoint to read sensitive workflow data including submitted form variables, approver identities, approval and rejection comments, and process BPMN XML without ownership or tenant party verification.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
YunaiV · yudao-cloudpublic PoCs found — 1
cve_referencegithub.com/YunaiV/yudao-cloud/issues/315unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — YunaiV yudao-cloud
In the same product, most dangerous first.
CVE-2026-7710MEDIUMYunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authenticationEPSS 0.7%CVE-2026-7679MEDIUMYunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authenticationEPSS 0.7%CVE-2026-5147MEDIUMYunaiV yudao-cloud get-by-website sql injectionEPSS 0.4%CVE-2026-9464MEDIUMYunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgeryEPSS 0.4%CVE-2026-5148MEDIUMYunaiV yudao-cloud page sql injectionEPSS 0.3%CVE-2025-10277MEDIUMYunaiV yudao-cloud submit improper authorizationEPSS 0.3%