CVE-2026-2819

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.5.3. This vulnerability affects the function SaServletFilter of the file /workflow/instance/deleteByInstanceIds of the component Workflow Module. The manipulation leads to missing authorization. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-862 CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Feb 20, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-281907.1Subscriber Broken Access Control in ProLancer Element <= 1.4.8 versions.CVE-2026-281918.8Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The Grid: from n/a throug CVE-2026-281929.6Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions.CVE-2026-281935.3In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint CVE-2026-281946.1In JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flow CVE-2026-281954.3In JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add parameters to build configurations CVE-2026-281962.3In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk CVE-2026-281978.8An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could supply a specially crafted input to a pr CVE-2026-281988.8An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could bypass the cryptographic signature verif CVE-2026-281993.3An authenticated user with access to the NetBackup Flex OS management shell could read arbitrary files from the underlying operating system CVE-2026-28207.3A security flaw has been discovered in Fujian Smart Integrated Management Platform System up to 7.5. This issue affects some unknown process CVE-2026-282017.8An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker t