CVE-2025-55471

HIGH

youlai-boot <2.21.1 - Info Disclosure

Title source: llm

Incorrect access control in the getUserFormData function of youlai-boot v2.21.1 allows attackers to access sensitive information for other users.

Core 3

Core References

Third Party Advisory

Product

Exploit, Issue Tracking, Vendor Advisory

CVSS v3 7.5

EPSS 0.0006

EPSS Percentile 19.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

CWE

CWE-284 CWE-862

Status published

Products (1)

youlai/youlai-boot 2.21.1

Published Nov 26, 2025

Tracked Since Feb 18, 2026