CVE-2026-110215: Privilege Escalation in youlai-boot via Missing Authorization

CVE-2026-110215 describes a missing authorization vulnerability in youlai-boot versions up to 2.21.1. The flaw resides within the role permission management API, specifically the PUT /api/v1/roles/{roleId}/menus endpoint. An authenticated user, including low-privileged accounts such as a test or guest account, can interact with this endpoint to arbitrarily modify permissions assigned to specific roles. By assigning administrative menu and button permissions to their own role and triggering a refresh of the Redis-backed permission cache, an attacker can effectively escalate their privileges to administrator-equivalent access. This vulnerability poses a significant risk to organizations relying on youlai-boot for role-based access control (RBAC), as it allows for trivial bypass of intended security boundaries within the application.

Impact

Successful exploitation of CVE-2026-110215 results in complete privilege escalation within the youlai-boot application. An attacker with minimal user privileges can grant themselves full administrative control, enabling unauthorized access to sensitive data, administrative features, and management of other user accounts. This compromises the integrity and confidentiality of the entire application environment.

Recommendation

Prioritized actions for security and IT teams:

• Upgrade youlai-boot to a version later than 2.21.1 immediately to patch the authorization flaw.
• Audit access logs for the PUT /api/v1/roles/{roleId}/menus endpoint to identify potentially unauthorized role permission modifications.
• Review all current role and permission assignments within the application for discrepancies or signs of unauthorized elevation.
• Enforce strict monitoring on sensitive API endpoints that modify application-level access controls.