CVE-2026-116016: Reliance on Untrusted Inputs in a Security Decision in YunaiV yudao-cloud
Affects YunaiV yudao-cloudSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:NWhat to do
AI-suggested
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to /admin-api endpoints to trusted users only and monitor for unusual use of the data-permission-enable header. Avoid relying on client-controlled headers for authorization decisions.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| YunaiVyudao-cloud | Affected
| Fixed in– |
GitHub Actionsyudao-cloudpkg:github/yudao-cloudOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
CVE-2026-116016 is an authorization bypass vulnerability in yudao-cloud through version 2026.09. Authenticated users can bypass row-level data scope restrictions by sending a specially crafted header (data-permission-enable set to false) in /admin-api requests. This allows unauthorized reading or modification of other departments' and users' records within the same tenant.
References
- github.com/YunaiV/yudao-cloud/issues/343 (opens in a new tab)
- github.com/YunaiV/yudao-cloud/commit/4e415cd6c30d3abb929a127bb7038101d9f4c943 (opens in a new tab)
- github.com/YunaiV/yudao-cloud/blob/d322a10b9898a084412032e94336af06835978c2/yudao-framework/yudao-spring-boot-starter-biz-data-permission/src/main/java/cn/iocoder/yudao/framework/datapermission/core/rpc/DataPermissionRpcWebFilter.java (opens in a new tab)
- github.com/YunaiV/yudao-cloud/blob/d322a10b9898a084412032e94336af06835978c2/yudao-gateway/src/main/java/cn/iocoder/yudao/gateway/filter/security/TokenAuthenticationFilter.java (opens in a new tab)
- hackmd.io/@hieuPenguinnn/yudao-cloud-data-permission-enable-header-datascope-bypass (opens in a new tab)
- vulncheck.com/advisories/yudao-cloud-through-2026.09-data-permission-bypass-via-data-permission-enable-header (opens in a new tab)