PT-2026-122597

CVE-2026-116016

·

Published

2026-10-24

·

Updated

2026-10-24

Description by

CVSS 3.1
7.1
High
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to /admin-api requests, which DataPermissionRpcWebFilter trusts, to read or modify other departments' and users' records within the same tenant.
Exploitability
Fix
Researchers
Vendors
Affected products
Weakness enumeration
CWE-807: Reliance on Untrusted Inputs in a Security Decision
Related identifiers
CVE-2026-116016
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com