CVE-2026-110215: youlai-boot through 2.21.1 Missing Authorization in Role Menu Assignment Allows Privilege Escalation
youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/{roleId}/menus. Low-privileged users such as the GUEST test account can grant all permissions to their own role, refreshing the Redis permission cache to gain administrator-equivalent access.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with access to the affected role-menu assignment endpoint can exploit it. The description specifically notes that a low-privileged GUEST test account can grant permissions to its own role.
What does an attacker need to do to gain elevated access?
The attacker sends a PUT request to /api/v1/roles/{roleId}/menus to assign arbitrary menu and button permissions to a role. By assigning all permissions to their own role and refreshing the Redis permission cache, they can obtain administrator-equivalent access.
Are unauthenticated attackers affected by this vulnerability?
No. Exploitation requires authentication and low privileges, as reflected by the PR:L vector and the described use of an authenticated GUEST account.
How can defenders determine whether exploitation may have occurred?
Review requests to PUT /api/v1/roles/{roleId}/menus, particularly changes that assign broad menu or button permissions to low-privileged roles. Also investigate permission-cache refreshes in Redis that coincide with unexpected role permission changes.