yudao-cloud: Authorization bypass in DataPermissionRpcWebFilter (CVE-2026-116016)
An authorization bypass vulnerability in yudao-cloud through 2026.09 allows authenticated users to circumvent row-level data scope restrictions by injecting a header, leading to unauthorized access to cross-departmental and cross-user records.
CVE search metadata
CVE search record: CVE-2026-116016. Severity: high. CVSS: 7.1. KEV: no. Product: yudao-cloud (<= 2026.09). Brief: yudao-cloud: Authorization bypass in DataPermissionRpcWebFilter (CVE-2026-116016). Brief link: https://feed.craftedsignal.io/briefs/2026-10-yudao-cloud-auth-bypass/
Triage facts
Revision 1- Applicability
- yudao-cloud (<= 2026.09)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 24, 14:16 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
yudao-cloud versions through 2026.09 contain an authorization bypass vulnerability (CVE-2026-116016). The vulnerability resides in the DataPermissionRpcWebFilter component, which improperly trusts the 'data-permission-enable' HTTP header. Authenticated users can set this header to 'false' to disable row-level data scope restrictions, allowing them to read or modify records belonging to other departments or users within the same tenant.
Impact
Successful exploitation allows authenticated users to bypass row-level access control, resulting in unauthorized data access or modification of records belonging to other users or departments.
Recommendation
- Inventory all instances of yudao-cloud within the environment.
- Implement an immediate block or strict validation at the API gateway or WAF level to reject requests to /admin-api containing the 'data-permission-enable' header if its value is 'false'.
- Patch to the latest version of yudao-cloud once an update addressing CVE-2026-116016 is released by the vendor.
- Monitor application logs for API requests containing the 'data-permission-enable: false' header to identify potential exploitation attempts.
Immediate actions
Configure WAF or API gateway to inspect and reject requests to /admin-api that contain the header data-permission-enable: false
Threat Hunt
Identify authenticated users sending requests to /admin-api with the header data-permission-enable: false
Data: Web server access logs or API gateway logs (request headers)
Mitigations
Apply security vendor patch for CVE-2026-116016
CVE-2026-116016