CVE-2026-116016
Received Received - Intake

Authorization Bypass in yudao-cloud via Data Permission Header

Publication date: 2026-10-24

Last updated on: 2026-10-24

Assigner: VulnCheck

Description
yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to /admin-api requests, which DataPermissionRpcWebFilter trusts, to read or modify other departments' and users' records within the same tenant.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-24
Last Modified
2026-10-24
Generated
2026-10-24
AI Q&A
2026-10-24
EPSS Evaluated
N/A
NVD
CVE-2026-116016
EUVD
EUVD-2026-109274

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
YunaiV yudao-cloud 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-807 The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authorization bypass vulnerability in yudao-cloud through version 2026.09. Authenticated users can evade row-level data scope restrictions by sending a 'data-permission-enable' header set to false. The system's DataPermissionRpcWebFilter trusts this header unconditionally, disabling data permission checks and allowing users to read or modify records belonging to other departments or users within the same tenant.

Detection Guidance

Check HTTP request logs for the presence of the 'data-permission-enable: false' header in /admin-api requests. Use tools like tcpdump or Wireshark to inspect traffic for this header. Monitor for unauthorized data access patterns in application logs.

Impact Analysis

An attacker with authenticated access could bypass data restrictions to read or modify sensitive business records across modules like CRM, ERP, OA, HRM, and user management. This could lead to unauthorized data exposure, data corruption, or privilege escalation within the same tenant.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating data protection principles in GDPR and HIPAA. It undermines access controls required for compliance, potentially resulting in data breaches and regulatory penalties.

Mitigation Strategies

Update yudao-cloud to the latest patched version. Configure the gateway to strip the 'data-permission-enable' header from all requests. Ensure the DataPermissionRpcWebFilter only processes /rpc-api/** paths.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116016. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart