CVE-2026-116016: yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header
yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to /admin-api requests, which DataPermissionRpcWebFilter trusts, to read or modify other departments' and users' records within the same tenant.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who can send requests to /admin-api can exploit it. The impact is limited to records within the same tenant, but may include other departments' and users' data.
What does an attacker need to send?
The attacker needs to include the data-permission-enable header with the value false on a /admin-api request. The affected filter trusts this client-controlled header and disables row-level data scope enforcement.
Are unauthenticated users affected?
The available information describes exploitation by authenticated users. It does not state that unauthenticated access can exploit the bypass.
How can I check for attempted exploitation?
Review /admin-api request logs for authenticated requests containing data-permission-enable: false. Correlate matching requests with reads or modifications involving records outside the requesting user's normal department or data scope.