CVE-2025-10987: medium-severity vulnerability in YunaiV yudao-cloud
YunaiV yudao-cloud HTTP Request transfer improper authorization
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.3%
A vulnerability was determined in YunaiV yudao-cloud up to 2025.09. Affected by this issue is some unknown functionality of the file /crm/contact/transfer of the component HTTP Request Handler. This manipulation of the argument contactId causes improper authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The affected component should be upgraded. The vendor confirms: "The controllers check the relevant update permission and obtain the acting user ID from the authenticated server context. The services require CRM OWNER permission and call transferPermission, which explicitly rejects a caller who is neither the owner nor an authorized CRM administrator."
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
YunaiV · yudao-cloudRelated CVEs — YunaiV yudao-cloud
In the same product, most dangerous first.
CVE-2026-7679MEDIUMYunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authenticationEPSS 0.4%CVE-2026-7710MEDIUMYunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authenticationEPSS 0.4%CVE-2026-58448HIGHyudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance APIEPSS 0.4%CVE-2026-9464MEDIUMYunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgeryEPSS 0.4%CVE-2026-5147MEDIUMYunaiV yudao-cloud get-by-website sql injectionEPSS 0.3%CVE-2025-10277MEDIUMYunaiV yudao-cloud submit improper authorizationEPSS 0.3%