CVE-2026-2819

2.1 lowEPSS 0.3%

Low (2.1). EPSS 0.3% chance of exploitation in the next 30 days.

A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.5.3. This vulnerability affects the function SaServletFilter of the file /workflow/instance/deleteByInstanceIds of the component Workflow Module. The manipulation leads to missing authorization. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

CVSS 4.0

2.1 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

6.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
CWEs: CWE-862, CWE-863
Published: 2026-02-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://vuldb.com/?ctiid.346944
https://vuldb.com/?id.346944
https://vuldb.com/?submit.753321

Check your stack JSON