CVE-2025-66736: High severity youlai-boot vulnerability

Published Dec 22, 2025

Updated

youlai-boot V2.21.1 is vulnerable to Incorrect Access Control. The importUsers function in SysUserController.java does not perform a permission check on the current user's identity, which may allow regular users to import user data into the database, resulting in an authorization bypass vulnerability.

Affected Software

2 affected components

youlai-boot=2.21.1

youlai youlai-boot=2.21.1

Remediation

Patch Available

https://gitee.com/youlaiorg/youlai-boot/commit/9197065102f92264ded814a9d3e9f2a4ff0da121

Event History

Dec 22, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·09:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-66736?

CVE-2025-66736 is classified as a high severity vulnerability due to the potential for authorization bypass.

How do I fix CVE-2025-66736?

To fix CVE-2025-66736, implement proper permission checks in the importUsers function of SysUserController.java.

Who is affected by CVE-2025-66736?

CVE-2025-66736 affects users of youlai-boot version 2.21.1.

What kind of vulnerability is CVE-2025-66736?

CVE-2025-66736 is an Incorrect Access Control vulnerability allowing unauthorized user data import.

Can regular users exploit CVE-2025-66736?

Yes, regular users may exploit CVE-2025-66736 to import user data into the database without permission.