CVE-2026-102616 in WorkFlow-Engine
Summary
by MITRE • 09/29/2026
A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl.java of the component OAuth2 Resource Filter. Performing a manipulation of the argument year/processInstanceId results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The sink is injectable on two independent positions, not just one. The vendor was contacted early about this disclosure but did not respond in any way.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The risesoft-y9 WorkFlow-Engine software, specifically versions up to 9.6.10, contains a critical security flaw within its OAuth2 Resource Filter component that allows for remote code execution via SQL injection. The vulnerability resides in the CustomHistoricProcessServiceImpl.java file, targeting the getByIdAndYear function which is responsible for retrieving historical process data based on specific identifiers and temporal parameters. This architectural placement means that any request passing through this filter can potentially trigger the vulnerable logic if it interacts with historic process queries involving year or instance IDs. The presence of an unpatched SQL injection sink in a component handling authentication-adjacent filtering significantly elevates the risk profile, as attackers may leverage existing credentials or exploit public-facing endpoints to initiate malicious payloads without needing prior high-level access privileges.
The technical nature of this flaw involves improper neutralization of special elements used in SQL commands within the getByIdAndYear method. When user-supplied input for the year or processInstanceId arguments is passed directly into database queries without adequate sanitization, parameterization, or validation, an attacker can manipulate these inputs to alter the intended SQL logic. The vulnerability is particularly severe because it manifests at two independent injection points rather than a single isolated location. This dual-vector nature increases the attack surface and makes exploitation more reliable for threat actors who may encounter different input constraints depending on how they interact with the application interface or API endpoints. By injecting malicious SQL syntax, an attacker can bypass authentication checks, extract sensitive data from underlying databases such as user credentials or workflow configurations, modify existing records, or potentially execute administrative commands if the database service account has elevated privileges.
From a classification perspective, this vulnerability aligns directly with CWE-89 Improper Neutralization of Special Elements used in an SQL Command and is categorized under OWASP Top 10 A03:2021 Injection. In terms of tactical mapping to the MITRE ATT&CK framework, this flaw facilitates Data from Information Repositories (T1005) for data exfiltration and potentially Privilege Escalation if database permissions are misconfigured. The fact that remote exploitation is possible means that a network-connected system running an affected version can be compromised over TCP/IP without requiring local access or physical interaction with the server infrastructure. This characteristic makes it highly attractive to automated scanning tools and opportunistic attackers who routinely probe for known vulnerable endpoints in enterprise workflow management systems.
The operational impact of this vulnerability extends beyond simple data theft. Workflow engines often manage critical business processes, including financial approvals, HR actions, and supply chain logistics. Compromising the integrity or confidentiality of these workflows can lead to significant organizational disruption, regulatory non-compliance, and reputational damage. Since the exploit code is now public in the wild, automated attacks are likely already occurring against internet-facing instances of this software. Organizations running risesoft-y9 WorkFlow-Engine versions prior to 9.6.10 face an immediate and active threat landscape where their systems may be targeted by script kiddies or advanced persistent threats seeking a foothold within internal networks through the workflow application layer.
Mitigation strategies must prioritize immediate remediation given the public availability of exploits. The primary defense is upgrading to a patched version released after 9.6.10 that addresses the input validation issues in CustomHistoricProcessServiceImpl.java. If an upgrade is not immediately feasible, organizations should implement strict web application firewall rules to detect and block SQL injection patterns targeting the specific endpoints associated with historic process queries. Additionally, network segmentation can help limit lateral movement if a compromise occurs by restricting database access from the workflow engine servers to only necessary internal services. Input validation practices such as using prepared statements or parameterized queries are essential for preventing this class of vulnerability in future development cycles. Continuous monitoring of application logs for anomalous SQL query structures and regular penetration testing will further enhance visibility into potential exploitation attempts while waiting for vendor patches, although the lack of response from risesoft suggests that relying solely on official updates may require contingency planning involving alternative workflow solutions or custom code fixes applied by internal security teams.