This vulnerability in YunaiV yudao-cloud 2026.03 allows an attacker with high privileges to manipulate the IotDataSinkHttpConfig function in the Admin API Endpoint, leading to server-side request forgery. The flaw exists in the /admin-api/iot/data-sink/create endpoint, enabling remote exploitation without user interaction. The vendor has not issued a fix or advisory, and the vulnerability has been publicly disclosed. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required for attack initiation, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with high privileges to cause the server to make unintended requests, potentially accessing internal resources or services. The impact is rated medium with a CVSS 4.0 score of 5.1. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, organizations should restrict access to the affected API endpoint to trusted users with high privileges and monitor for unusual request patterns. Avoid exposing the vulnerable endpoint to untrusted networks until a fix is released.