Youlai Youlai-boot vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Youlai Youlai-boot: 4 record(s), with affected versions and fixes.cpe:2.3:a:youlai:youlai-boot
CVE-2025-66736
High · 7.1
CWE-284 Dec 22, 2025
Improper Access Control in Youlai Youlai-boot
youlai-boot V2.21.1 is vulnerable to Incorrect Access Control. The importUsers function in SysUserController.java does not perform a permission check on the current user's identity, which may allow regular users to import user data into the database, resulting in an authorization bypass vulnerability.
CVE-2025-66735
High · 7.5
CWE-284 Dec 22, 2025
Improper Access Control in Youlai Youlai-boot
youlai-boot V2.21.1 is vulnerable to Incorrect Access Control. The getRoleForm function in SysRoleController.java does not perform permission checks, which may allow non-root users to directly access root roles.
CVE-2025-55471
High · 7.5
CWE-284 Nov 26, 2025
Improper Access Control in Youlai Youlai-boot
Incorrect access control in the getUserFormData function of youlai-boot v2.21.1 allows attackers to access sensitive information for other users.
CVE-2025-55469
Critical · 9.8
CWE-863 Nov 26, 2025
Incorrect Authorization in Youlai Youlai-boot
Incorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges and access the Administrator backend.