CVE-2025-66735

High CVSS: 7.5

youlai-boot V2.21.1 is vulnerable to Incorrect Access Control. The getRoleForm function in SysRoleController.java does not perform permission checks, which may allow non-root users to directly access root roles.

Vendor

Youlai

Product

Youlai-boot

CWE

CWE-284

Yayın Tarihi

2025-12-22 21:15:44

Güncelleme

2026-01-06 15:18:03

Source Identifier

cve@mitre.org

KEV Date Added

Kategoriler

CWE-284 Youlai-boot HIGH Youlai 2025

Referanslar

https://gist.github.com/old6ma/dc9e6e4a693d12c1a35fd4e1d21d4743 https://gitee.com/youlaiorg/youlai-boot/commit/9197065102f92264ded814a9d3e9f2a4ff0da121 https://gitee.com/youlaiorg/youlai-boot/issues/ICH8FR

Benzer Kayıtlar

Medium

CVE-2026-3287

A security flaw has been discovered in youlaitech youlai-mall 2.0.0. This affects the function listPagedSpuForApp of the…

Medium

CVE-2025-15372

A weakness has been identified in youlaitech vue3-element-admin up to 3.4.0. This issue affects some unknown processing…

Medium

CVE-2025-15087

A security vulnerability has been detected in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function submitOrderPa…

Medium

CVE-2025-15086

A weakness has been identified in youlaitech youlai-mall 1.0.0/2.0.0. This impacts the function getMemberByMobile of the…

Medium

CVE-2025-15085

A security flaw has been discovered in youlaitech youlai-mall 1.0.0/2.0.0. This affects the function deductBalance of th…

Low

CVE-2025-15084

A vulnerability was identified in youlaitech youlai-mall 1.0.0/2.0.0. The impacted element is the function orderService.…