CVE-2025-66735: High severity youlai-boot vulnerability
youlai-boot V2.21.1 is vulnerable to Incorrect Access Control. The getRoleForm function in SysRoleController.java does not perform permission checks, which may allow non-root users to directly access root roles.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66735?
CVE-2025-66735 has a high severity due to its exploitation potential allowing unauthorized access to sensitive roles.
How do I fix CVE-2025-66735?
To fix CVE-2025-66735, update your youlai-boot software to the latest version with improved access control checks implemented.
Who is affected by CVE-2025-66735?
Users of youlai-boot version 2.21.1 are affected by CVE-2025-66735, especially those without proper security configurations.
What does CVE-2025-66735 exploit?
CVE-2025-66735 exploits a lack of permission checks in the getRoleForm function, allowing non-root users access to root roles.
What should I do if I cannot update youlai-boot for CVE-2025-66735?
If you cannot update youlai-boot, ensure that strict access controls and user permissions are configured to mitigate risks associated with CVE-2025-66735.