CVE-2026-110215
HighCVSS 8.8Summary
youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/{roleId}/menus. Low-privileged users such as the GUEST test account can grant all permissions to their own role, refreshing the Redis permission cache to gain administrator-equivalent access.
Risk Assessment
The risk includes privilege escalation by low-privileged users, potentially leading to full system control and data confidentiality compromise.
Recommendation
It is recommended to immediately upgrade youlai-boot to a patched version and implement authorization checks for the /api/v1/roles/{roleId}/menus endpoint.
Other vulnerabilities in youlai-boot
See all- CVE-2026-110216High
youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/{userId}/status to disable root or admin accounts, locking administrators out, or re-enable accounts an administrator has disabled.
- CVE-2025-55469Critical
Incorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges and access the Administrator backend.
Original NVD description (English source)
youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/{roleId}/menus. Low-privileged users such as the GUEST test account can grant all permissions to their own role, refreshing the Redis permission cache to gain administrator-equivalent access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS