The vulnerability in youlaitech's youlai-boot application allows any authenticated user to enable or disable user accounts through the /api/v1/users/{userId}/status PATCH endpoint. Because the updateUserStatus handler lacks an @PreAuthorize check, an attacker can arbitrarily alter the status of any account, including root or administrator accounts. This flaw permits an authenticated attacker to lock out administrators by disabling their accounts or to resurrect accounts a legitimate admin has disabled, thereby compromising the integrity and availability of privileged accounts.

The affected product is youlaitech’s youlai-boot, a Spring Boot based REST API. Versions up to and including 2.21.1 are impacted. The vulnerability originates in the UserController class that handles user status updates.

The CVSS score of 7.1 indicates a high severity vulnerability. No EPSS score is publicly available, and the issue is not listed in the CISA KEV catalog, suggesting no broad exploitation has been documented yet. Nevertheless, the flaw can be exploited remotely via standard HTTP PATCH requests once the attacker is authenticated. The lack of authorization on this endpoint makes it trivial for an attacker to increase their control over the system by disabling or enabling user accounts, which poses a significant risk to the availability of administrative access.