CVE-2026-110215

Summary

The vulnerability allows authenticated users to bypass authorization controls by assigning arbitrary menu and button permissions to their roles, effectively granting them administrator-level access. This occurs through a PUT request to the roles/menus endpoint that refreshes Redis permission cache.

Exploitability

Exploitation is straightforward for authenticated users who can make a single PUT request to /api/v1/roles/{roleId}/menus, requiring no special privileges or complex payloads beyond basic authentication.

Blast radius

The impact could be significant as low-privileged users like GUEST accounts can escalate to full administrator access, potentially compromising the entire application and its data.

Detection

Monitor for unauthorized PUT requests to /api/v1/roles/{roleId}/menus endpoints with elevated permission assignments, particularly from low-privileged user accounts.

Prioritized remediation

Upgrade to youlai-boot 2.21.2 or later to address this missing authorization vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.