CVE-2026-110216
HighCVSS 7.1Summary
youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/{userId}/status to disable root or admin accounts, locking administrators out, or re-enable accounts an administrator has disabled.
Risk Assessment
The risk includes the ability to disable administrator accounts, leading to lockout, and re-enabling accounts that were intentionally disabled, compromising access control.
Recommendation
It is recommended to immediately upgrade youlai-boot to a patched version and add proper authorization checks to the updateUserStatus handler.
Other vulnerabilities in youlai-boot
See all- CVE-2026-110215High
youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/{roleId}/menus. Low-privileged users such as the GUEST test account can grant all permissions to their own role, refreshing the Redis permission cache to gain administrator-equivalent access.
- CVE-2025-55469Critical
Incorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges and access the Administrator backend.
Original NVD description (English source)
youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/{userId}/status to disable root or admin accounts, locking administrators out, or re-enable accounts an administrator has disabled.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS