CVE-2026-110215 in youlai-boot
Summary
by MITRE • 10/13/2026
youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/{roleId}/menus. Low-privileged users such as the GUEST test account can grant all permissions to their own role, refreshing the Redis permission cache to gain administrator-equivalent access.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in youlai-boot versions through 2.21.1 represents a critical failure in server-side access control mechanisms, specifically manifesting as an insecure direct object reference combined with missing function-level authorization checks. This flaw resides within the API endpoint PUT /api/v1/roles/{roleId}/menus, which is designed to update menu and button permissions associated with specific user roles. The core technical deficiency lies in the application's inability to verify whether the authenticated actor initiating the request possesses sufficient privileges to modify the permission set of a target role. Instead of validating that the requester holds administrative rights or has explicit ownership over the specified roleId, the backend logic blindly accepts any valid session token and applies the provided menu structure directly to the designated role entity in the database. This architectural oversight effectively bypasses standard privilege escalation controls, allowing any authenticated user with minimal initial privileges to manipulate high-level security configurations.
The operational impact of this vulnerability is severe, as it facilitates a direct path from low-privileged access to full administrative control over the application environment. An attacker utilizing a basic account, such as the default GUEST test account often present in development or testing environments, can exploit this endpoint by sending a PUT request that assigns all available menu and button permissions to their own role identifier. Upon successful execution of this malicious payload, the system updates the database records for that specific role to include every permission node defined within the application's security schema. This action effectively elevates the attacker's privileges from a restricted guest level to an equivalent status of a super administrator without requiring any additional authentication factors or exploitation of secondary vulnerabilities.
A critical component amplifying the severity and persistence of this attack is the integration with Redis for caching user permissions. In many modern web applications, permission data is cached in memory stores like Redis to optimize performance during subsequent requests. When an attacker modifies the role's permissions via the vulnerable endpoint, the application typically triggers a cache refresh or invalidation process that repopulates the session-specific permission set from the newly updated database records. Consequently, the elevated privileges granted by the exploit are immediately recognized and enforced for all future actions performed under that user context. This means that once the initial PUT request succeeds, the attacker gains immediate and persistent administrative access across the entire application surface area, including sensitive management interfaces, data modification tools, and system configuration panels.
From a classification perspective, this vulnerability aligns with CWE-285 Improper Authorization, as the software does not perform proper checks to ensure authorized users are allowed access to specific resources or functions. It also relates closely to CWE-639 Injection of Critical Function via Untrusted Input if one considers the role assignment logic itself as a critical function that should be restricted. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior is indicative of T1078 Valid Accounts and potentially T1068 Exploitation for Privilege Escalation, where an adversary leverages legitimate credentials to gain higher-level access within the system. The exploitation does not require complex payload construction or buffer overflow techniques; it relies solely on the logical failure to enforce role-based access control boundaries during administrative operations.
Mitigation strategies must focus on implementing robust server-side authorization checks before processing any modification requests related to user roles and permissions. Developers should ensure that every API endpoint handling sensitive configuration changes verifies that the requesting user possesses an explicit admin or super-admin role, rather than relying solely on general authentication tokens. Additionally, input validation should be enforced not only for data integrity but also for access control context, ensuring that a user can only modify their own profile unless they hold elevated privileges. It is crucial to review and harden all endpoints involved in RBAC (Role-Based Access Control) management to prevent unauthorized privilege escalation. Furthermore, organizations should conduct regular security audits of authentication modules and consider implementing principle-of-least-privilege defaults for test accounts like GUEST to reduce the attack surface available during initial exploitation phases.