The flaw is a missing authorization check on the role menu assignment API in youlai-boot. An authenticated user can send a PUT request to /api/v1/roles/{roleId}/menus and assign any menu or button permissions to a role. When a low‑privileged account, such as the default GUEST account, uses this endpoint, it can grant all permissions to its role and then trigger a cache refresh, effectively elevating itself to an administrator. This is a classic missing access control problem (CWE‑862) that compromises the confidentiality and integrity of the system by allowing an attacker to grant arbitrary privileges to a role they control.

The affected product is youlaitech youlai-boot, version 2.21.1 and every earlier release. Users running this version or earlier need to upgrade or remediate.

The CVSS score of 8.7 indicates high severity while the EPSS score of less than 1% reflects a very low but non‑zero probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker only needs legitimate authentication and network access to the REST API; no advanced skills are required beyond constructing a properly formatted HTTP PUT request to the /api/v1/roles/{roleId}/menus endpoint. When exploited, the attacker achieves administrator‑equivalent privileges, making this a high‑risk issue for any exposed deployment.