CVE-2026-110216

Awaiting Analysis Awaiting Analysis - Queue

Authentication Bypass in Youlai-Boot via User Status Update

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/{userId}/status to disable root or admin accounts, locking administrators out, or re-enable accounts an administrator has disabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110216

EUVD

EUVD-2026-99257

Affected Vendors & Products

Vendor	Product	Version / Range
youlaitech	youlai-boot	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-110216 is a missing authorization vulnerability in youlai-boot through version 2.21.1. It allows any authenticated user to send PATCH requests to /api/v1/users/{userId}/status to disable or re-enable accounts, including root or admin accounts. This is due to the updateUserStatus handler lacking a @PreAuthorize check, enabling attackers to lock administrators out or bypass account restrictions.

Detection Guidance

Check for unauthorized PATCH requests to /api/v1/users/{userId}/status endpoints. Monitor logs for any user status changes, especially for admin or root accounts. Verify if @PreAuthorize annotations are missing on user status update handlers in UserController.java.

Impact Analysis

An attacker could exploit this to disable critical accounts like root or admin, locking administrators out of the system. They could also re-enable previously disabled accounts, potentially restoring access for malicious users or disrupting normal operations.

Mitigation Strategies

Apply the latest patches from the youlai-boot repository that add @PreAuthorize annotations to sensitive endpoints. Restrict network access to admin endpoints. Review logs for suspicious activity and disable unauthorized account changes.

Hi! I’m here to help you understand CVE-2026-110216. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70