Cpe:2.3:a:yudao-Cloud:yudao-Cloud:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3ayudao-cloudyudao-cloud/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 24 Oct 2026 14:16:37 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgyudao-cloud: Authorization bypass in DataPermissionRpcWebFilter (CVE-2026-116016)https://feed.craftedsignal.io/briefs/2026-10-yudao-cloud-auth-bypass/Sat, 24 Oct 2026 14:16:37 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-yudao-cloud-auth-bypass/An authorization bypass vulnerability in yudao-cloud through 2026.09 allows authenticated users to circumvent row-level data scope restrictions by injecting a header, leading to unauthorized access to cross-departmental and cross-user records.yudao-cloud versions through 2026.09 contain an authorization bypass vulnerability (CVE-2026-116016). The vulnerability resides in the DataPermissionRpcWebFilter component, which improperly trusts the 'data-permission-enable' HTTP header. Authenticated users can set this header to 'false' to disable row-level data scope restrictions, allowing them to read or modify records belonging to other departments or users within the same tenant.

Impact

Successful exploitation allows authenticated users to bypass row-level access control, resulting in unauthorized data access or modification of records belonging to other users or departments.

Recommendation

  1. Inventory all instances of yudao-cloud within the environment.
  2. Implement an immediate block or strict validation at the API gateway or WAF level to reject requests to /admin-api containing the 'data-permission-enable' header if its value is 'false'.
  3. Patch to the latest version of yudao-cloud once an update addressing CVE-2026-116016 is released by the vendor.
  4. Monitor application logs for API requests containing the 'data-permission-enable: false' header to identify potential exploitation attempts.
]]>highadvisoryauthorization-bypassapi-securitycloud