CVE-2026-110216: youlai-boot through 2.21.1 Missing Authorization in User Status Update Endpoint
youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/{userId}/status to disable root or admin accounts, locking administrators out, or re-enable accounts an administrator has disabled.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user can exploit it. The vulnerable handler does not enforce an authorization check, so the attacker does not need administrative privileges.
What access and request are required to abuse the endpoint?
An attacker needs a valid authenticated account and the ability to send a PATCH request to /api/v1/users/{userId}/status. No user interaction is required.
What is the practical impact on account administration?
An attacker can disable root or administrator accounts, potentially locking administrators out. They can also re-enable accounts that an administrator previously disabled.
Which versions are identified as affected?
youlai-boot through version 2.21.1 is identified as affected.