CVE-2026-110216

HighCVSS 7.1/10Last modified Oct 16, 2026

Description

youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/{userId}/status to disable root or admin accounts, locking administrators out, or re-enable accounts an administrator has disabled.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 16, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1102176.5Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operaCVE-2026-1102183.7Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blogCVE-2026-1102195.4QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the priCVE-2026-110226.5Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromisedCVE-2026-1102207.1Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controlCVE-2026-1102215.4QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the AdminHotelFeaturePricesSettings form that echoes featurCVE-2026-1102225.3Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests byCVE-2026-1102233.1Kavita 0.9.0 through 0.9.1.4 contains a server-side request forgery vulnerability that allows authenticated users to bypass the SSRF blockliCVE-2026-1102245.4QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in AdminSearchConfController::processSave() that echoes rejectCVE-2026-1102252.7Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request interCVE-2026-1102265.4QloApps through 1.7.0 contains a broken access control vulnerability that allows hotel-restricted back-office employees to create room typesCVE-2026-1102275.3Missing Authorization vulnerability in 10up Restricted Site Access restricted-site-access allows Exploiting Incorrectly Configured Access Co
CVE-2026-110216: High severity, CVSS 7.1 | Vulnix