Vendor
An authorization bypass vulnerability in yudao-cloud through 2026.09 allows authenticated users to circumvent row-level data scope restrictions by injecting a header, leading to unauthorized access to cross-departmental and cross-user records.