CVE-2026-110216

The youlai-boot software (through version 2.21.1 ) is vulnerable to a missing authorization flaw in the updateUserStatus handler. The root cause is the absence of a @PreAuthorize check, which allows any authenticated user to send PATCH requests to the /api/v1/users/{userId}/status endpoint. This ...