CVE-2026-116016

HighCVSS 7.1/10Last modified Oct 24, 2026

Description

yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to /admin-api requests, which DataPermissionRpcWebFilter trusts, to read or modify other departments' and users' records within the same tenant.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-807

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
YunaiVyudao-cloud<= 2026.09

References

Timeline

Published
Oct 24, 2026
Last modified
Oct 24, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-1160174.3Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBCVE-2026-1160184.3ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to markCVE-2026-1160198.8Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by rCVE-2026-1160205.4BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to accessCVE-2026-116036.1The Product Filter Widget for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'args[filterFormArray]' ParCVE-2026-116046.5An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authentiCVE-2026-116057.5The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, evCVE-2026-116077.6Backend users with access to the Form Framework were able to use files not ending in .form.yaml as form definitions, which were processed wiCVE-2026-116086.1The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3_fname' parameter in all versionsCVE-2026-11613.5A vulnerability was detected in pbrong hrms 1.0.1. The affected element is the function UpdateRecruitmentById of the file /handler/recruitmeCVE-2026-116108.8A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integriCVE-2026-116116.5A flaw was found in 389 Directory Server. The Content Synchronization persistent search plugin allows unbounded memory growth when an authen