CVE-2026-116016

yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header

View on CVE.org
Published Oct 24, 2026 CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Description
yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to /admin-api requests, which DataPermissionRpcWebFilter trusts, to read or modify other departments' and users' records within the same tenant.

Analysis

AI-generated

Technical impact

This vulnerability allows an authenticated user to circumvent row‑level data restrictions by adding a data‑permission‑enable header set to false to their HTTP requests. When the request hits the /admin-api endpoints, the DataPermissionRpcWebFilter trusts this header and permits the attacker to read or modify records from other departments or users within the same tenant, effectively breaching intended access boundaries.

Affected Systems

YunaiV’s yudao-cloud platform, version 2026.09 and earlier, including components that implement the DataPermissionRpcWebFilter and the TokenAuthenticationFilter. The issue resides in the yudao‑framework and yudao‑gateway modules referenced in the source code links.

Risk and Exploitability

The CVSS score of 7.1 indicates high severity, while the EPSS score is not currently available and the vulnerability is not listed in CISA’s KEV catalog. Attackers need a valid authenticated session and must include the data‑permission‑enable:false header in a request to an /admin-api endpoint. The exploit is remote, application‑level and delivered via an HTTP header, so it requires network access to the API surface and user authentication credentials, but does not rely on privileged system processes or operating system vulnerabilities.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to yudao-cloud 2026.10 or later where the data‑permission‑enable header handling is fixed; if an update is unavailable, apply the upstream patch commit 4e415cd6c30d3abb929a127bb7038101d9f4c943 to the source code and rebuild the application.
  • Reconfigure the gateway or application to strip or reject the data‑permission‑enable header from incoming requests, ensuring that only the server trusts internal data‑permission settings; alternatively, disable the header altogether in configuration if the framework provides such a switch.
  • If an immediate update or gateway reconfiguration is impossible, use a network‑level rule or reverse proxy to strip or drop the data‑permission‑enable header for all admin API traffic, preventing the filter from receiving the bypass token.

Generated by OpenCVE AI on October 24, 2026 at 12:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Yunaiv
Yunaiv yudao-cloud
Vendors & Products Yunaiv
Yunaiv yudao-cloud
Type Values Removed Values Added
Description yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to /admin-api requests, which DataPermissionRpcWebFilter trusts, to read or modify other departments' and users' records within the same tenant.
Title yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header
Weaknesses CWE-807
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}
Weaknesses
  • CWE-807

    Reliance on Untrusted Inputs in a Security Decision

Sources

Status
PUBLISHED
Assigner
VulnCheck
Published
Updated
Nov 3, 2026, 4:17 PM
Reserved
Oct 24, 2026, 11:23 AM

View source JSON

Updated
Nov 3, 2026, 4:17 PM

JSON

Status
Deferred
Published
Oct 24, 2026, 12:16 PM
Modified
Nov 3, 2026, 5:17 PM

View source JSON

No data.

Updated
Oct 24, 2026, 1:00 PM

JSON