vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-116016

yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header

HIGH
7.1
CVSS Score
Published: October 24, 2026 at 11:40 AM UTC
Updated: October 26, 2026 at 05:12 PM UTC
1 product affected across 1 vendorYudao Cloud

Using yudao-cloud by YunaiV?

Get instant alerts when new vulnerabilities affect yudao-cloud - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.1
Exploit prediction
EPSS 0.3%

Description

yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to /admin-api requests, which DataPermissionRpcWebFilter trusts, to read or modify other departments' and users' records within the same tenant.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Yudao Cloud· Yunaiv
90%
All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (6)

Issue Tracking
Source: cverecord
https://github.com/YunaiV/yudao-cloud/issues/343
Patch
Source: cverecord
https://github.com/YunaiV/yudao-cloud/commit/4e415cd6c30d3abb929a127bb7038101d9f4c943
Technical Description
Source: cverecord
https://github.com/YunaiV/yudao-cloud/blob/d322a10b9898a084412032e94336af06835978c2/yudao-framework/yudao-spring-boot-starter-biz-data-permission/src/main/java/cn/iocoder/yudao/framework/datapermission/core/rpc/DataPermissionRpcWebFilter.java#L21-L36
Technical Description
Source: cverecord
https://github.com/YunaiV/yudao-cloud/blob/d322a10b9898a084412032e94336af06835978c2/yudao-gateway/src/main/java/cn/iocoder/yudao/gateway/filter/security/TokenAuthenticationFilter.java#L84-L92
Third Party Advisory
Source: cverecord
https://hackmd.io/@hieuPenguinnn/yudao-cloud-data-permission-enable-header-datascope-bypass
Third Party Advisory
Source: cverecord
https://www.vulncheck.com/advisories/yudao-cloud-through-2026.09-data-permission-bypass-via-data-permission-enable-header

CVSS

7.1HIGHVulnCheck
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-807

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card