PT-2026-53997 · Unknown · Yudao-Cloud

George Chen · Published 2026-06-30 · Updated 2026-06-30 · CVE-2026-58448

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions yudao-cloud versions prior to 2026.06

Description A broken access control issue exists in the BPM module. An authenticated user can access arbitrary process instance records by providing a caller-controlled process-instance identifier to an unprotected GET endpoint that lacks the @PreAuthorize annotation. This allows the retrieval of sensitive workflow data, such as submitted form variables, approver identities, approval and rejection comments, and process BPMN XML, without ownership or tenant party verification.

Recommendations Update yudao-cloud to version 2026.06 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-58448

Affected Products

Yudao-Cloud

References · 5

• 🔥 https://github.com/YunaiV/yudao-cloud/issues/315 · Exploit
• https://github.com/YunaiV/yudao-cloud/releases#release-v2026.06(jdk8/11) · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-58448 · Security Note
• https://twitter.com/CVEnew/status/2072076779892990039 · Twitter Post
• https://vulncheck.com/advisories/yudao-cloud-bpm-module-broken-access-control-via-process-instance-api · Note