youlaitech youlai-boot up to 2.21.1 User Status status updateUserStatus userId missing authentication

Summaryinfo

A vulnerability categorized as problematic has been discovered in youlaitech youlai-boot up to 2.21.1. Affected is the function updateUserStatus of the file /api/v1/users/{userId}/status of the component User Status Handler. Executing a manipulation of the argument userId can lead to missing authentication. This vulnerability is tracked as CVE-2026-110216. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in youlaitech youlai-boot up to 2.21.1. It has been declared as problematic. This vulnerability affects the function updateUserStatus of the file /api/v1/users/{userId}/status of the component User Status Handler. The manipulation of the argument userId with an unknown input leads to a missing authentication vulnerability. The CWE definition for the vulnerability is CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. As an impact it is known to affect integrity, and availability. CVE summarizes:

youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/{userId}/status to disable root or admin accounts, locking administrators out, or re-enable accounts an administrator has disabled.

The advisory is available at hackmd.io. This vulnerability was named CVE-2026-110216 since 10/13/2026. The exploitation appears to be easy. The attack can be initiated remotely. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 10/13/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• youlaitech

Name

• youlai-boot

Version

• 2.21.0
• 2.21.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion