Vendor
An authenticated low-privileged user can exploit a missing authorization vulnerability in youlai-boot to assign administrative permissions to their own role and elevate privileges.