PT-2025-52688 · Unknown · Youlai-Boot

Old6Ma · Published 2025-12-22 · Updated 2025-12-22 · CVE-2025-66736

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions youlai-boot version 2.21.1

Description The software contains an authorization bypass due to incorrect access control. The importUsers function within the SysUserController.java component does not verify the permissions of the current user. This allows standard users to import user data into the database, circumventing intended authorization restrictions. The vulnerable function is importUsers.

Recommendations Ensure the importUsers function in SysUserController.java includes appropriate permission checks to verify the user's identity and authorization before allowing data import operations.

Fix

Improper Access Control

Missing Authorization

Weakness Enumeration

CWE-284

CWE-862

Related Identifiers

CVE-2025-66736

Affected Products

Youlai-Boot

References · 8

• https://osv.dev/vulnerability/CVE-2025-66736 · Vendor Advisory
• https://gitee.com/youlaiorg/youlai-boot/commit/9197065102f92264ded814a9d3e9f2a4ff0da121 · Patch
• https://gitee.com/youlaiorg/youlai-boot/issues/ICH8FV · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66736 · Security Note
• https://gist.github.com/old6ma/be1d4a5373ee2de901ed4c8d81485046 · Note
• https://twitter.com/CVEnew/status/2003233968649568755 · Twitter Post
• https://t.me/cveNotify/146612 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2003226912475222041 · Twitter Post