How do I check whether I am affected by CVE-2026-116016?

Check yudao-cloud version (<= 2026.09 affected): grep -ri yudao pom.xml. Check DataPermissionRpcWebFilter reads data-permission-enable without a path check. Test: as a limited-scope admin, call a scoped /admin-api list endpoint with and without header 'data-permission-enable: false' and compare row counts. Check gateway/proxy config strips that header.

What is the fix for CVE-2026-116016?

No released fixed version yet (affected through 2026.09). Upstream fix is commit 4e415cd6c30d3abb929a127bb7038101d9f4c943 on the master-jdk17 branch: gateway strips external data-permission-enable and login-user headers before every auth branch; DataPermissionRpcWebFilter only honors the header on /rpc-api/ paths. Until a release, cherry-pick the commit, or strip the data-permission-enable request header at the gateway/reverse proxy. Rely on network isolation for /rpc-api (no RPC auth added).

Who is not affected by CVE-2026-116016?

Not affected if: header-stripped-at-proxy, no-data-scope-roles, no-data-scope-rules, patched-master-jdk17, single-tenant-deployment.

Live › vulnerability › CVE-2026-116016

Go to dashboard

high7.1Package

yudao-cloud: forged header bypasses row-level data scope restrictions

Q: What is the fix for CVE-2026-116016?

No released fixed version yet (affected through 2026.09). Upstream fix is commit 4e415cd6c30d3abb929a127bb7038101d9f4c943 on the master-jdk17 branch: gateway strips external data-permission-enable and login-user headers before every auth branch; DataPermissionRpcWebFilter only honors the header on /rpc-api/ paths. Until a release, cherry-pick the commit, or strip the data-permission-enable request header at the gateway/reverse proxy. Rely on network isolation for /rpc-api (no RPC auth added).

Q: Who is not affected by CVE-2026-116016?

Not affected if: header-stripped-at-proxy, no-data-scope-roles, no-data-scope-rules, patched-master-jdk17, single-tenant-deployment.

yudao-cloud through 2026.09 trusts a client-supplied data-permission-enable header on /admin-api requests. An authenticated user can set it to false to read or modify other departments' and users' records within the same tenant.

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

7.1

high

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 24, 2026 UTC
Last modified: Oct 25, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-24 12:47 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: No.
Reachable from: internet.
Worst case: Authenticated user reads or modifies other departments' records.
CVSS said: 7.1. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

1 product

Self-hosted multi-tenant yudao-cloud (Spring Cloud, JDK17/21 line) deployments through 2026.09 where staff roles have department-only or self-only data scope. Any logged-in admin-api user can see and edit other departments' and users' records in their tenant (CRM, ERP, OA, HRM, system users). Can skip it if you do not use data-scope roles, or if a proxy already strips the header.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-116016

Go to dashboard

high7.1Package

yudao-cloud: forged header bypasses row-level data scope restrictions

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

7.1

high

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 24, 2026 UTC
Last modified: Oct 25, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-24 12:47 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: No.
Reachable from: internet.
Worst case: Authenticated user reads or modifies other departments' records.
CVSS said: 7.1. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

yudao-cloud: forged header bypasses row-level data scope restrictions

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

yudao-cloud: forged header bypasses row-level data scope restrictions

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources