Vulnerabilidades do Youlaitech Youlai-boot

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Youlaitech Youlai-boot: 3 registro(s), com versões afetadas e correções.

CVE-2026-110216 Alta · 7.1 CWE-862 13/10/2026

youlai-boot through 2.21.1 Missing Authorization in User Status Update Endpoint

youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/{userId}/status to disable root or admin accounts, locking administrators out, or re-enable accounts an administrator has disabled.

CVE-2026-110215 Alta · 8.8 CWE-862 13/10/2026

youlai-boot through 2.21.1 Missing Authorization in Role Menu Assignment Allows Privilege Escalation

youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/{roleId}/menus. Low-privileged users such as the GUEST test account can grant all permissions to their own role, refreshing the Redis permission cache to gain administrator-equivalent access.

CVE-2026-7672 Média · 6.3 CWE-74 02/05/2026

youlaitech youlai-boot Users Endpoint UserController.java getUserList sql injection

A security vulnerability has been detected in youlaitech youlai-boot up to 2.21.1. This affects the function getUserList of the file src/main/java/com/youlai/boot/system/controller/UserController.java of the component Users Endpoint. Such manipulation of the argument order leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.