CVE-2025-66736

high

youlai-boot V2.21.1 is vulnerable to Incorrect Access Control.

Vendor / product: Youlai — youlai-boot

youlai-boot V2.21.1 is vulnerable to Incorrect Access Control. The importUsers function in SysUserController.java does not perform a permission check on the current user's identity, which may allow regular users to import user data into the database, resulting in an authorization bypass vulnerability.

CVSS

7.1

7.1 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Severity source: NVD CVSS v3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Timeline (UTC)

Published: 2025-12-22 21:15

Modified: 2026-11-04 22:10

NVD status: Analyzed

Last synced 2 hours ago

Verified against the source API 2026-11-04 22:37 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

youlai / youlai-boot 2.21.1

Weakness classification (CWE)

CWE-284 CWE-862

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://gitee.com/youlaiorg/youlai-boot/issues/ICH8FV

Patch / mitigation: https://gitee.com/youlaiorg/youlai-boot/commit/9197065102f92264ded814a9d3e9f2a4ff0da121

References

https://gist.github.com/old6ma/be1d4a5373ee2de901ed4c8d81485046 cve@mitre.org
https://gitee.com/youlaiorg/youlai-boot/commit/9197065102f92264ded814a9d3e9f2a4ff0da121 cve@mitre.org
https://gitee.com/youlaiorg/youlai-boot/issues/ICH8FV cve@mitre.org

Data sources

NVD CVE API 2.0 — fetched 2026-11-04 22:37 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

Related CVEs

CVE-2025-55469