CVE-2026-110216 in youlai-boot
Zusammenfassung
von MITRE • 13.10.2026
youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/{userId}/status to disable root or admin accounts, locking administrators out, or re-enable accounts an administrator has disabled.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.