CVE-2026-110216highCWE-862

CVE-2026-110216: falha de alta gravidade em youlaitech youlai-boot

youlai-boot through 2.21.1 Missing Authorization in User Status Update Endpoint

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar youlai-boot

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.4%
youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/{userId}/status to disable root or admin accounts, locking administrators out, or re-enable accounts an administrator has disabled.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Produtos afetados
youlaitech · youlai-boot
CVEs relacionadas — youlaitech youlai-boot

No mesmo produto, das mais perigosas para as menos.

CVE-2026-110215HIGHyoulai-boot through 2.21.1 Missing Authorization in Role Menu Assignment Allows Privilege EscalationEPSS 0.5%CVE-2026-7672MEDIUMyoulaitech youlai-boot Users Endpoint UserController.java getUserList sql injectionEPSS 0.2%