youlai-boot CVE-2026-7672

Q: What is the CVSS score of CVE-2026-7672?

CVE-2026-7672 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26805 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-05-03 cna@vuldb.com

Java SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 03, 2026 - 00:30 vuln.today

EUVD ID Assigned

May 03, 2026 - 00:22 euvd

EUVD-2026-26805

Analysis Generated

May 03, 2026 - 00:22 vuln.today

CVE Published

May 03, 2026 - 00:16 nvd

LOW 2.1

DescriptionCVE.org

A security vulnerability has been detected in youlaitech youlai-boot up to 2.21.1. This affects the function getUserList of the file src/main/java/com/youlai/boot/system/controller/UserController.java of the component Users Endpoint. Such manipulation of the argument order leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in youlai-boot up to version 2.21.1 via argument order manipulation in the getUserList endpoint allows authenticated remote attackers to execute arbitrary SQL queries with limited data access impact. The vulnerability affects the Users Endpoint component, has publicly available exploit code, and the vendor has not responded to disclosure attempts despite early notification.

Technical ContextAI

youlai-boot is a Java-based backend framework. The vulnerability exists in the UserController.java file's getUserList function, which processes user list requests. The root cause is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), manifesting as SQL injection through unsafe parameter ordering. The getUserList endpoint fails to properly sanitize or parameterize SQL arguments when processing the order parameter, allowing an attacker to inject malicious SQL syntax by manipulating argument order rather than value injection. This is a parameter-manipulation-based SQLi variant rather than the more common string concatenation SQLi, suggesting the application constructs dynamic SQL without adequate parameterized query controls.

RemediationAI

Upgrade youlai-boot to a version beyond 2.21.1 immediately if available from the vendor. However, given the vendor's non-response to disclosure, check the official youlai-boot GitHub or Maven Central repository for patched versions published after the disclosure date. If no patch is available, implement the following compensating controls: (1) Restrict database user permissions assigned to the youlai-boot application connection to read-only access for user list queries, eliminating Write/Delete impact even if SQLi succeeds - this prevents data modification but does not prevent data exfiltration. (2) Apply Web Application Firewall rules to detect and block SQL metacharacters (e.g., UNION, SELECT, OR 1=1) in the order parameter of getUserList endpoint requests. (3) Enforce role-based access control to limit which user accounts can access the getUserList endpoint, reducing the attack surface to trusted internal users only. (4) Implement SQL query logging and alerting to detect anomalous queries originating from the UserController. References: VulDB submission 800658 and vuln/360825 (vuldb.com).