{"id":"CVE-2026-116016","summary":"yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header","details":"yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to /admin-api requests, which DataPermissionRpcWebFilter trusts, to read or modify other departments' and users' records within the same tenant.","modified":"2026-10-25T07:11:29.733589547Z","published":"2026-10-24T11:40:33.600Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-807"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116016.json","unresolved_ranges":[{"extracted_events":[{"strategy":"StandardRange","range":[{"last_affected":"2026.09"}],"source":"AFFECTED_FIELD"}]},{"extracted_events":[{"source":"DESCRIPTION","range":[{"last_affected":"2026.09"}]}]}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116016.json"},{"type":"PACKAGE","url":"https://github.com/YunaiV/yudao-cloud"},{"type":"ARTICLE","url":"https://github.com/YunaiV/yudao-cloud/blob/d322a10b9898a084412032e94336af06835978c2/yudao-framework/yudao-spring-boot-starter-biz-data-permission/src/main/java/cn/iocoder/yudao/framework/datapermission/core/rpc/DataPermissionRpcWebFilter.java#L21-L36"},{"type":"ARTICLE","url":"https://github.com/YunaiV/yudao-cloud/blob/d322a10b9898a084412032e94336af06835978c2/yudao-gateway/src/main/java/cn/iocoder/yudao/gateway/filter/security/TokenAuthenticationFilter.java#L84-L92"},{"type":"FIX","url":"https://github.com/YunaiV/yudao-cloud/commit/4e415cd6c30d3abb929a127bb7038101d9f4c943"},{"type":"REPORT","url":"https://github.com/YunaiV/yudao-cloud/issues/343"},{"type":"ADVISORY","url":"https://hackmd.io/@hieuPenguinnn/yudao-cloud-data-permission-enable-header-datascope-bypass"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116016"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/yudao-cloud-through-2026.09-data-permission-bypass-via-data-permission-enable-header"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/yunaiv/yudao-cloud","events":[{"introduced":"0"},{"fixed":"4e415cd6c30d3abb929a127bb7038101d9f4c943"}],"database_specific":{"extracted_events":[{"source":"REFERENCES_COMMIT","range":[{"fixed":"4e415cd6c30d3abb929a127bb7038101d9f4c943"}]}]}}],"versions":["v2026.09(jdk17/21)","v2026.08(jdk17/21)","v2026.07(jdk17/21)","v2026.06(jdk17/21)","v2026.05(jdk17/21)","v2026.04(jdk17/21)","v2026.03(jdk17/21)","v2026.01(jdk17/21)","v2025.12(jdk17/21)","v2025.11(jdk17/21)","v2025.10(jdk17/21)","v2025.09(jdk17/21)","v2025.08(jdk17/21)","v2.6.1(jdk17/21)","v2.6.0(jdk17/21)","v2.5.0(jdk8/11)","v2.5.0(jdk17/21)","v2.4.2(jdk17/21)","v2.4.1(jdk8/11)","v2.4.1(jdk17/21)","v2.4.0(jdk17/21)","v2.3.0(jdk17/21)","v2.1.0(jdk17/21)","v1.9.0","v1.8.3","v1.8.2","v1.8.1","v1.8.0","v1.7.3","v1.7.2","v1.7.1"],"database_specific":{"vanir_signatures_modified":"2026-10-25T07:11:29Z","source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-116016.json","vanir_signatures":[{"target":{"file":"yudao-framework/yudao-spring-boot-starter-biz-data-permission/src/main/java/cn/iocoder/yudao/framework/datapermission/core/rpc/DataPermissionRpcWebFilter.java"},"deprecated":false,"digest":{"line_hashes":["21843145359085822918646920085015967374","232527147186385317318263587849771083284","11557230613491815636913938818303950926","34416885443448624145426574040200104225","200227483623070308719280173316613574576"],"threshold":0.9},"id":"CVE-2026-116016-09b64bf3","signature_type":"Line","signature_version":"v1","source":"https://github.com/yunaiv/yudao-cloud/commit/4e415cd6c30d3abb929a127bb7038101d9f4c943"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/yunaiv/yudao-cloud/commit/4e415cd6c30d3abb929a127bb7038101d9f4c943","target":{"file":"yudao-gateway/src/main/java/cn/iocoder/yudao/gateway/util/SecurityFrameworkUtils.java"},"deprecated":false,"digest":{"line_hashes":["923914852032651999377867372116423784","303845853005956335740402981181805493624","258018967325895531531510894179391919955","135663575415593075386208389118673561722","44910890010875975750052252602089495331","205778172873904780916533395334205549538","205832606772871875529927520979886257812","248903374492360969652884626339658715959","9028431256519914435164603856940520923","169011446384146335589949833301584357137","43697361210925146780534110680827301304","148331081865131626006299689147675117206","294647894556459017105920902702686618924","274402675236215071089880836982707778506","32648806820245549075005683920704800069","332158781442431234584762084430996727464","269064225438006187476395430781705985291"],"threshold":0.9},"id":"CVE-2026-116016-1b3b6b28"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/yunaiv/yudao-cloud/commit/4e415cd6c30d3abb929a127bb7038101d9f4c943","target":{"file":"yudao-gateway/src/main/java/cn/iocoder/yudao/gateway/filter/security/TokenAuthenticationFilter.java"},"deprecated":false,"digest":{"line_hashes":["154176176124583245905824768738998134590","100610203550382289153403498411420976384","30410869515008721802958926522156792110","19898436711547650339401683174053643399"],"threshold":0.9},"id":"CVE-2026-116016-be6f9b08"},{"source":"https://github.com/yunaiv/yudao-cloud/commit/4e415cd6c30d3abb929a127bb7038101d9f4c943","target":{"file":"yudao-gateway/src/main/java/cn/iocoder/yudao/gateway/util/SecurityFrameworkUtils.java","function":"removeLoginUser"},"deprecated":false,"digest":{"function_hash":"302451437234372685727769371191306220279","length":345},"id":"CVE-2026-116016-c4e6011e","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"}]}