CVE-2025-66735

High · 7.5

CVSS

7.5

EPSS

0.4%

Published

Dec 22, 2025

CISA due date

—

The record

youlai-boot V2.21.1 is vulnerable to Incorrect Access Control. The getRoleForm function in SysRoleController.java does not perform permission checks, which may allow non-root users to directly access root roles.

Affected packages

Ecosystem	Package	Introduced	Fixed