CVE-2026-116016

The yudao-cloud software (through version 2026.09 ) is vulnerable to an authorization bypass that allows authenticated users to evade row-level data scope restrictions. The root cause is that the DataPermissionRpcWebFilter component trusts the data-permission-enable header. By sending this header...