---
id: "CVE-2026-116016"
kind: "vulnerability"
aliases: ["CVE-2026-116016"]
title: "yudao-cloud: forged header bypasses row-level data scope restrictions"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "yudao-cloud", "fixed": [], "affected": "<= 2026.09", "ecosystem": "github"}]
ecosystems: []
tags: ["admin-api", "auth-required", "java", "multi-tenant", "package", "self-hosted", "spring-cloud", "yudao-cloud"]
not_affected_if: ["header-stripped-at-proxy", "no-data-scope-roles", "no-data-scope-rules", "patched-master-jdk17", "single-tenant-deployment"]
published_at: "2026-10-24T12:16:57+00:00"
first_seen_at: "2026-10-24T12:47:58+00:00"
updated_at: "2026-10-25T03:31:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116016", "first_seen_at": "2026-10-24T12:47:58+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:31:31+00:00"}]
---

# yudao-cloud: forged header bypasses row-level data scope restrictions

yudao-cloud through 2026.09 trusts a client-supplied data-permission-enable header on /admin-api requests. An authenticated user can set it to false to read or modify other departments' and users' records within the same tenant.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:yudao-cloud affected <= 2026.09 fixed ?

## How to check

Check yudao-cloud version (<= 2026.09 affected): grep -ri yudao pom.xml. Check DataPermissionRpcWebFilter reads data-permission-enable without a path check. Test: as a limited-scope admin, call a scoped /admin-api list endpoint with and without header 'data-permission-enable: false' and compare row counts. Check gateway/proxy config strips that header.

## Fix

No released fixed version yet (affected through 2026.09). Upstream fix is commit 4e415cd6c30d3abb929a127bb7038101d9f4c943 on the master-jdk17 branch: gateway strips external data-permission-enable and login-user headers before every auth branch; DataPermissionRpcWebFilter only honors the header on /rpc-api/ paths. Until a release, cherry-pick the commit, or strip the data-permission-enable request header at the gateway/reverse proxy. Rely on network isolation for /rpc-api (no RPC auth added).

## Timeline

- 2026-10-24T12:47:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116016
- 2026-10-25T03:31:31+00:00 analyst — Fix is commit 4e415cd (2026-10-23) on master-jdk17 per maintainer in issue #343; no tagged release after 2026.09 found, maintainer said not yet pushed/released at the time, so fixed version unknown. Reporter writeup (hackmd) gives root cause; no exploitation or public PoC reported (writeup examples not executed).

## Documents

- [advisory] yudao-cloud issue #343 (maintainer confirms fix on master-jdk17) https://github.com/YunaiV/yudao-cloud/issues/343
- [advisory] NVD CVE-2026-116016 https://nvd.nist.gov/vuln/detail/CVE-2026-116016
- [describes] Reporter writeup: data-permission-enable header bypass https://hackmd.io/@hieuPenguinnn/yudao-cloud-data-permission-enable-header-datascope-bypass
- [fix] yudao-cloud fix commit 4e415cd: prevent external Header bypassing data permission https://github.com/YunaiV/yudao-cloud/commit/4e415cd6c30d3abb929a127bb7038101d9f4c943

## From the sources

yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to /admin-api requests, which DataPermissionRpcWebFilter trusts, to read or modify other departments' and users' records within the same tenant.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_