CVE-2026-116015: Authorization Bypass Through User-Controlled Key in YunaiV yudao-cloud
Affects YunaiV yudao-cloudSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NWhat to do
AI-suggested
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access controls on after-sale log endpoints and monitor for unusual access patterns involving afterSaleId enumeration.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| YunaiVyudao-cloud | Affected
| Fixed in– |
GitHub Actionsyudao-cloudpkg:github/yudao-cloudOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
CVE-2026-116015 is an authorization bypass vulnerability in the yudao-cloud product by YunaiV, affecting versions up to 2026.09. It allows authenticated users to access other members' after-sale operation logs by manipulating the afterSaleId parameter. This can expose sensitive information such as refund amounts, status changes, and timestamps.
References
- github.com/YunaiV/yudao-cloud/issues/344 (opens in a new tab)
- github.com/YunaiV/yudao-cloud/commit/df604fbd9824195ec3e48e2dfd3341c1d4e1edea (opens in a new tab)
- github.com/YunaiV/yudao-cloud/blob/593354d92a63f401ba73b95da868aade8c3d855d/yudao-module-mall/yudao-module-trade-server/src/main/java/cn/iocoder/yudao/module/trade/controller/app/aftersale/AppAfterSaleLogController.java (opens in a new tab)
- github.com/YunaiV/yudao-cloud/blob/593354d92a63f401ba73b95da868aade8c3d855d/yudao-module-mall/yudao-module-trade-server/src/main/java/cn/iocoder/yudao/module/trade/dal/mysql/aftersale/AfterSaleLogMapper.java (opens in a new tab)
- hackmd.io/@hieuPenguinnn/yudao-cloud-mall-after-sale-log-cross-member-idor (opens in a new tab)
- vulncheck.com/advisories/yudao-cloud-through-2026.09-idor-via-after-sale-log-list-endpoint (opens in a new tab)