youlai-boot EUVD-2026-99257

Exploitation requires the attacker to hold any valid authenticated session on a youlai-boot ≤2.21.1 instance (PR:L); no administrator or user-management permission is needed because the updateUserStatus handler in UserController (lines 114-126) lacks the @PreAuthorize('@ss.hasPerm('sys:user:edit')') guard that its sibling handlers enforce. The specific prerequisite is reachability of the PATCH /api/v1/users/{userId}/status endpoint by a logged-in non-privileged account. Limiting factors: a valid login is mandatory (not unauthenticated), no user interaction from a victim is required, it affects default configurations of the vulnerable versions, and the realistic impact is restricted to toggling account enable/disable status (administrative lockout or re-enabling disabled accounts) rather than data disclosure or code execution.

This is a moderate-priority, authenticated access-control flaw rather than a top-tier emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H, base 7.1 High) is internally consistent with the description: network-reachable, low attack complexity, but requires a low-privilege authenticated account (PR:L), with impact concentrated in availability (VA:H - locking admins out) and minor integrity (VI:L - flipping account status), and no confidentiality impact (VC:N). No EPSS score, CISA KEV listing, public POC, or SSVC decision data was provided in the input, so there is no positive signal of real-world or automated exploitation - exploitation status is therefore 'no public exploit identified at time of analysis.' The PR:L requirement is the main mitigating factor: an attacker needs valid credentials on the application before they can abuse the missing @PreAuthorize check, which argues against mass, unauthenticated internet-scale exploitation. The 7.1 rating is driven almost entirely by the self-inflicted-DoS potential (disabling root/admin accounts), not by code execution or data exposure; defenders should treat it as a privilege/authorization-boundary bug whose worst case is administrative lockout, not full compromise.

A low-privileged but authenticated user of a youlai-boot ≤2.21.1 deployment sends a crafted PATCH request to /api/v1/users/{userId}/status targeting the root or an admin account, disabling it and locking legitimate administrators out of the panel. Because the updateUserStatus handler is missing the @PreAuthorize('@ss.hasPerm(...)') check present on sibling endpoints, the request succeeds despite the user lacking user-management permissions. No public exploit code was identified in the provided data, but the attack is trivial to reproduce from the vendor fix diff.