CVE-2026-116016: yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header
Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.
Generated by VEDAS. Scores as of 2026-11-11 15:49 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.
What it is
yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to /admin-api requests, which DataPermissionRpcWebFilter trusts, to read or modify other departments’ and users’ records within the same tenant.
Description quoted from the CVE record (assigned by VulnCheck, published 2026-10-24).
Weakness: Reliance on Untrusted Inputs in a Security Decision
How it can be exploited
Exploitable over the network with low attack complexity with no special attack requirements needing low privileges and no user interaction. Impact: confidentiality high, integrity low, availability none. CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CISA assessment (SSVC): CISA assesses that a public proof of concept exists. Automatable: no. Technical impact: partial.
Public exploit evidence (Exploit Observer)
Exploit Observer found 3 code repositories naming this CVE.
Code repositories that name a CVE are often scanners, copies or fakes, and some are malware. Read the code before running anything.
See all 5 references on Exploit Observer
Live scores
- EPSS
- 0.003
low predicted chance of attack - VEDAS
- 0.987
strong exploit evidence - On CISA KEV
- Not listed
- Detection rule
- Suricata
Who is affected
| Product | Affected | Not affected |
|---|---|---|
| YunaiV yudao-cloud | up to and including 2026.09 | Not stated |
Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.
How to fix it
Vendor guidance:
How to detect it
Suricata rules (network detection)
1 rule that alert on traffic matching this exploit: VEDAS CVE-2026-116016 yudao-cloud - Data Scope Authorization Bypass via data-permission-enable Header. Add them to your Suricata rule set and reload.
Show the rules
alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-116016 yudao-cloud - Data Scope Authorization Bypass via data-permission-enable Header"; flow:established,to_server; http.uri; content:"/admin-api"; fast_pattern; nocase; http.header; content:"data-permission-enable"; nocase; pcre:"/data-permission-enable\s*\x3a\s*false/Hi"; classtype:web-application-attack; reference:cve,CVE-2026-116016; reference:url,https://www.exploit.observer/?keyword=CVE-2026-116016&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=yudao-cloud&match=exact; sid:1090205; rev:1;)
CVE-2026-116016.rules on GitHub
References
Vendor advisories and patches
Technical analysis and advisories
- https://github.com/YunaiV/yudao-cloud/issues/343 (issue-tracking)
- https://github.com/YunaiV/yudao-cloud/blob/d322a10b9898a084412032e94336af06835978c2/yudao-framework/yudao-spring-boot-starter-biz-data-permission/src/main/java/cn/iocoder/yudao/framework/datapermission/core/rpc/DataPermissionRpcWebFilter.java#L21-L36 (technical-description)
- https://github.com/YunaiV/yudao-cloud/blob/d322a10b9898a084412032e94336af06835978c2/yudao-gateway/src/main/java/cn/iocoder/yudao/gateway/filter/security/TokenAuthenticationFilter.java#L84-L92 (technical-description)
- https://hackmd.io/@hieuPenguinnn/yudao-cloud-data-permission-enable-header-datascope-bypass (third-party-advisory)
- VulnCheck Advisory: yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header (third-party-advisory)
Other databases
Where this comes from
This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.
Supporting partners
