CVE-2025-66735

HIGH

youlai-boot 2.21.1 - Privilege Escalation

Title source: llm

Description

youlai-boot V2.21.1 is vulnerable to Incorrect Access Control. The getRoleForm function in SysRoleController.java does not perform permission checks, which may allow non-root users to directly access root roles.

Exploits (1)

References (3)

Scores

CVSS v3 7.5
EPSS 0.0007
EPSS Percentile 21.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-284 CWE-862
Status published
Products (1)
youlai/youlai-boot 2.21.1
Published Dec 22, 2025
Tracked Since Feb 18, 2026