Authorization Bypass Vulnerability in yudao-cloud by YunaiV

CVE-2026-116016

What is CVE-2026-116016?

The yudao-cloud product by YunaiV has an authorization bypass vulnerability that enables authenticated users to circumvent row-level data scope restrictions. By sending a specific header (data-permission-enable set to false) in API requests, attackers can exploit trust in the DataPermissionRpcWebFilter, gaining access to read or modify records belonging to other departments and users within the same tenant. This loophole poses a significant risk to data integrity and access control within the application.

References