youlai-boot CVE-2025-66735

The exact prerequisite is reachability of the youlai-boot admin application's role-management endpoint backed by the getRoleForm method in SysRoleController.java, which performs no permission/authorization check before returning role form data. Per the description, the realistic actor is a logged-in non-root user who requests the form for a root role they should not be authorized to view - so authentication to the application is the practical limiting factor, despite the input CVSS vector stating PR:N. Exploitation is limited to deployments running the vulnerable V2.21.1 and requires network reach to the admin interface; impact is confined to disclosure of role configuration, with no write or availability effect.

This is a moderate-severity Incorrect Access Control flaw (CWE-284) in the youlai-boot Java/Spring Boot admin system. The signals partially conflict: the input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it 7.5 with no privileges required, yet the description explicitly says 'non-root users' can access root roles - which implies an authenticated low-privileged account is needed, not a fully unauthenticated attacker. This discrepancy should be verified with the vendor; the realistic access requirement is likely PR:L rather than PR:N. Supporting signals point to modest real-world urgency rather than an emergency: EPSS is low at 0.44% (38th percentile), the CVE is NOT in CISA KEV (no confirmed active exploitation), and the only exploit artifact is a reference, not verified working exploit code. The vuln.today decision label is 'this_week', consistent with a patch-promptly priority rather than act_now/emergency. Impact is confidentiality-only (C:H/I:N/A:N) - unauthorized disclosure of role configuration - with no integrity or availability effect. Net: a legitimate issue worth patching on a normal cycle, but it is a high-CVSS-but-moderate-real-risk item given the low EPSS, absence of KEV, unverified PoC, and the niche deployment footprint of the affected product.

An attacker with a low-privileged (non-root) account on a youlai-boot V2.21.1 admin instance calls the getRoleForm endpoint in SysRoleController and, because no permission check is enforced, retrieves the configuration of root-level roles they should not be able to view. A public PoC reference exists (a gist and a Gitee issue), but it is not verified as working exploit code; the network attack vector and low complexity make the request itself trivial once the attacker can reach the application.