Yudao Cloud CVE-2026-116016

Exploitation requires a valid authenticated account within the target tenant (PR:L); the attacker simply adds the header data-permission-enable: false to requests under /admin-api (and, per the fix, /app-api). No non-default configuration, user interaction, or elevated privilege is needed - the pre-patch DataPermissionRpcWebFilter trusts this header on all request paths by default. Limiting factors: the attacker must already hold tenant credentials, and the exposed data is confined to other departments' and users' records within the same tenant (no cross-tenant access described).

The CVSS 4.0 score of 7.1 (High) reflects a low-complexity, network-reachable trust-boundary flaw (CWE-807, reliance on an untrusted HTTP input for a security decision): AV:N, AC:L, AT:N, PR:L, UI:N with VC:H and VI:L. The signals are internally consistent - the source diff confirms DataPermissionRpcWebFilter trusted the data-permission-enable header on externally reachable /admin-api and /app-api paths, so exploitation is trivial for anyone holding a valid tenant account, with no race, timing, or attacker-uncontrolled precondition implied by the metrics. No CISA KEV listing and no EPSS score are provided in the input, so widespread or automated exploitation cannot be asserted; a public PoC reference exists (a hackmd write-up and the VulnCheck advisory) but is not verified as working exploit code. The vuln.today Decision label is this_week, indicating this should be prioritized for patching this week rather than treated as an emergency. Net: a genuine, easily-triggered authorization bypass whose real-world urgency is tempered by the PR:L requirement (a valid authenticated account) and the same-tenant confinement of the exposed data, with impact weighted toward confidentiality (VC:H) and limited integrity (VI:L), no availability impact.

A low-privileged but authenticated user of a yudao-cloud tenant (for example an ordinary employee account) adds the HTTP header data-permission-enable: false to a normal /admin-api request such as a customer or user listing. The DataPermissionRpcWebFilter honors the header and disables row-level data-scope filtering, returning or letting them modify records belonging to other departments and users in the same tenant. A public write-up describing the technique exists, though it is not verified as working exploit code.