CVE-2026-110216

🗓️ 13 Oct 2026 18:50:04Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 14 Views🌐 WEB

Authenticated users can update account statuses in youlai-boot via missing authorization.

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2026-110216	13 Oct 202619:12	–	circl
Cvelist	CVE-2026-110216 youlai-boot through 2.21.1 Missing Authorization in User Status Update Endpoint	13 Oct 202618:50	–	cvelist
EUVD	EUVD-2026-99257	13 Oct 202618:50	–	euvd
Mend	CVE-2026-110216	13 Oct 202618:50	–	mend
NVD	CVE-2026-110216	13 Oct 202619:18	–	nvd
osv_cve	CVE-2026-110216 youlai-boot through 2.21.1 Missing Authorization in User Status Update Endpoint	13 Oct 202618:50	–	osv_cve
Positive Technologies	PT-2026-111840	13 Oct 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-110216: Missing Authorization	13 Oct 202600:00	–	rapid7
Vulnrichment	CVE-2026-110216 youlai-boot through 2.21.1 Missing Authorization in User Status Update Endpoint	13 Oct 202618:50	–	vulnrichment

Vulners

CNA

Node

youlai youlai-bootRange≤2.21.1

[
  {
    "vendor": "youlaitech",
    "product": "youlai-boot",
    "packageURL": "pkg:github/youlaitech/youlai-boot",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "0",
        "lessThanOrEqual": "2.21.1",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "repo": "https://github.com/youlaitech/youlai-boot"
  }
]

Source	Link
vulncheck	www.vulncheck.com/advisories/youlai-boot-through-2.21.1-missing-authorization-in-user-status-update-endpoint
hackmd	www.hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/youlai-boot-role-menu-assignment-and-user-status-missing-authorization
github	www.github.com/youlaitech/youlai-boot/blob/v2.21.1/src/main/java/com/youlai/boot/system/controller/UserController.java
github	www.github.com/youlaitech/youlai-boot/commit/86a9b3e212ff5a5537b0c7050c7802aea7fe486f

Parameter	Position	Path	Description	CWE
{userId}	path	/api/v1/users/{userId}/status	The updateUserStatus handler lacks a @PreAuthorize check, allowing any authenticated user to enable or disable accounts by sending a PATCH request.	CWE-862

16 Oct 2026 23:16Current

5.8Medium risk

Vulners AI Score5.8

CVSS 47.1

CVSS 3.17.1

EPSS0.00436

SSVC

CWE-862