Skip to content
OpenAdvisories

Vendor

youlaitech

14 known vulnerabilities.

Products

youlai-mall 10 youlai-boot 3 vue3-element-admin 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.1
    CVE-2026-110216

    youlai-boot through 2.21.1 Missing Authorization in User Status Update Endpoint

    youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/{us…

    youlaitech youlai-boot
  • High 8.8
    CVE-2026-110215

    youlai-boot through 2.21.1 Missing Authorization in Role Menu Assignment Allows Privilege Escalation

    youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/{roleId}/menus. Low-privileged users such as the GUEST test account can gr…

    youlaitech youlai-boot