Youlaitech vulnerabilities
We track 7 vulnerabilities in Youlaitech products across 2 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on October 13, 2026.
Latest Youlaitech vulnerabilities
- 7.1 High severity
youlai-boot: Missing Authorization
youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/{use
- 8.8 High severity
youlai-boot: Missing Authorization
youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/{roleId}/menus. Low-privileged users such as the GUEST test account can gra
- 9.8 Critical severity
youlai-mall: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in youlaitech youlai-mall 2.0.0. This affects the function listPagedSpuForApp of the file mall-pms/pms-boot/src/main/java/com/youlai/mall/pms/controller/app/SpuController.java of the component App-side Product Pagination End
- 8.1 High severity
youlai-mall: Incorrect Authorization
A security flaw has been discovered in youlaitech youlai-mall 1.0.0/2.0.0. This affects the function deductBalance of the file mall-ums/ums-boot/src/main/java/com/youlai/mall/ums/controller/app/MemberController.java of the component Balance Handler. The manipu
- 8.8 High severity
youlai-mall: Incorrect Privilege Assignment
A vulnerability was found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is an unknown function of the file /app-api/v1/members/openid/. The manipulation of the argument openid results in improper access controls. The attack can be executed remotely. The expl
- 8.8 High severity
youlai-mall: Improper Control of Dynamically-Managed Code Resources
A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0. This impacts an unknown function of the file /app-api/v1/orders/. The manipulation of the argument orderId leads to improper control of dynamically-identified variables. Remote exploitation
- 8.8 High severity
youlai-mall: Improper Control of Dynamically-Managed Code Resources
A flaw has been found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function getById/updateAddress/deleteAddress of the file /mall-ums/app-api/v1/addresses/. Executing manipulation can lead to improper control of dynamically-identified variables. The