Vulnerability · Published Jun 30, 2026 · Assigned by VulnCheck

CVE-2026-58448yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API

Medium 6.5

In plain English

A medium-severity missing authorization in yudao-cloud from YunaiV. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 65.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

yudao-cloud before 2026.06 contains a broken access control vulnerability in the BPM module that allows any authenticated user to access arbitrary process instance records by supplying a caller-controlled process-instance identifier to an unprotected endpoint lacking the @PreAuthorize annotation. Attackers can query any process-instance identifier through the unguarded GET endpoint to read sensitive workflow data including submitted form variables, approver identities, approval and rejection comments, and process BPMN XML without ownership or tenant party verification.

Affected products (as reported)

Vendor	Product	Versions
YunaiV	yudao-cloud	0 – before 2026.06

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Release Notes release-notes, patch
Researcher Disclosure technical-description, exploit
https://www.vulncheck.com/advisories/yudao-cloud-bpm-module-broken-access-control-via-process-instance-api third-party-advisory