Priority LOW 31
youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00415 · Published 2026-10-14 · No fix listed CWE-639
Priority LOW 32
youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00436 · Published 2026-10-13 · No fix listed CWE-862
Priority HIGH 73
youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/{roleId}/menus.
CVSS 4.0HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.00471 · Published 2026-10-13 · No fix listed CWE-862
Priority MEDIUM 57
A security vulnerability has been detected in youlaitech youlai-boot up to 2.21.1.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00246 · Published 2026-05-03 · No fix listed CWE-74
Priority MEDIUM 57
A security flaw has been discovered in youlaitech youlai-mall 2.0.0.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.0043 · Published 2026-02-27 · No fix listed CWE-74
Priority MEDIUM 55
A weakness has been identified in youlaitech vue3-element-admin up to 3.4.0.
CVSS 4.0MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.0028 · Published 2025-12-31 · No fix listed CWE-79
Priority MEDIUM 57
A security vulnerability has been detected in youlaitech youlai-mall 1.0.0/2.0.0.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00269 · Published 2025-12-25 · No fix listed CWE-266
Priority MEDIUM 57
A weakness has been identified in youlaitech youlai-mall 1.0.0/2.0.0.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.003 · Published 2025-12-25 · No fix listed CWE-266
Priority MEDIUM 57
A security flaw has been discovered in youlaitech youlai-mall 1.0.0/2.0.0.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00303 · Published 2025-12-25 · No fix listed CWE-266
Priority MEDIUM 45
A vulnerability was identified in youlaitech youlai-mall 1.0.0/2.0.0.
CVSS 4.0LOW 2.3· Network · Low privileges · No interaction · EPSS 0.00287 · Published 2025-12-25 · No fix listed CWE-266
Priority LOW 31
youlai-boot V2.21.1 is vulnerable to Incorrect Access Control.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00319 · Published 2025-12-22 · No fix listed CWE-284
Priority LOW 39
youlai-boot V2.21.1 is vulnerable to Incorrect Access Control.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0044 · Published 2025-12-22 · No fix listed CWE-284
Priority MEDIUM 57
A vulnerability was found in youlaitech youlai-mall 1.0.0/2.0.0.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00343 · Published 2025-12-05 · No fix listed CWE-266
Priority MEDIUM 57
A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00435 · Published 2025-12-05 · No fix listed CWE-913
Priority LOW 24
A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00279 · Published 2025-12-05 · No fix listed CWE-266
Priority MEDIUM 57
A flaw has been found in youlaitech youlai-mall 1.0.0/2.0.0.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00515 · Published 2025-12-04 · No fix listed CWE-913
Priority HIGH 72
Incorrect access control in the getUserFormData function of youlai-boot v2.21.1 allows attackers to access sensitive information for other users.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00365 · Published 2025-11-26 · No fix listed CWE-284
Priority HIGH 82
Incorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges and access the Administrator backend.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00454 · Published 2025-11-26 · No fix listed CWE-284
THREATIST.IORead the docs