CVE-2025-66735

HIGH 7.5CVE-2025-66735 · Published 22/12/2025 · updated 26/10/2026

In short

CVE-2025-66735 is a HIGH (CVSS 7.5) vulnerability affecting youlai-boot (youlai).
Chance of exploitation in the next 30 days (EPSS): 0.44%, higher than 38.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
youlai-boot youlai	`= 2.21.1`	No fix yet

Description

youlai-boot V2.21.1 is vulnerable to Incorrect Access Control. The getRoleForm function in SysRoleController.java does not perform permission checks, which may allow non-root users to directly access root roles.

References

gist.github.com/old6ma/dc9e6e4a693d12c1a35fd4e1d21d4743 · Third Party Advisory
gitee.com/youlaiorg/youlai-boot/commit/9197065102f92264ded814a9d3e9f2a4ff0da121 · Patch
gitee.com/youlaiorg/youlai-boot/issues/ICH8FR · Exploit

More vulnerabilities in youlai-boot

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free