CVE-2026-116016

yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header

7.1 High

yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to /admin-api requests, which DataPermissionRpcWebFilter trusts, to read or modify other departments' and users' records within the same tenant.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: Low
Availability: None

Exploit likelihood

0.25%Unchanged since Oct 25, 2026

What each source reports

CVE List Score used 7.1

yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header

Record: CVE-2026-116016
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Weakness: CWE-807
Updated: 2026-11-03

EUVDEUVD-2026-109274 7.1

Record: EUVD-2026-109274
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-g4h2-v8gg-9pg9 7.1

yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows...

Record: GHSA-g4h2-v8gg-9pg9
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Weakness: CWE-807
Updated: 2026-11-02

NVD 7.1

Record: CVE-2026-116016
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Weakness: CWE-807
Updated: 2026-11-03

OSV 7.1

yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header

Record: CVE-2026-116016
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-807
Updated: 2026-11-05

Affected products

yunaiv yudao-cloud

History

History
Recorded	Changed	Sources
Nov 3, 2026	references	CVE List
Nov 3, 2026	facts	EUVD
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-116016 is a high vulnerability (CVSS 7.1) in Yunaiv Yudao-cloud, published October 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 17th percentile. No source names a fixed version.

References

Show 4 moreShow less