youlai-boot vulnerabilities

2 known vulnerabilities in youlai-boot from Youlaitech. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  youlai-boot: Missing Authorization

  CVE-2026-110216Oct 13, 2026Youlaitech

  youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/{use

• 8.8 High severity

  youlai-boot: Missing Authorization

  CVE-2026-110215Oct 13, 2026Youlaitech

  youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/{roleId}/menus. Low-privileged users such as the GUEST test account can gra