Summary
Youlai-Boot contains a missing authorization flaw in the role menu-permission management endpoint. An authenticated, low-privileged user may assign arbitrary menu and button permissions to a role they control, potentially gaining administrator-equivalent access when the permission cache is refreshed.
Youlai-Boot contains a missing authorization flaw in the role menu-permission management endpoint. An authenticated, low-privileged user may assign arbitrary menu and button permissions to a role they control, potentially gaining administrator-equivalent access when the permission cache is refreshed.
Affected context
The issue affects deployments where authenticated users can reach the role-permission API and where authorization checks do not adequately restrict which roles or permissions they may modify. It becomes especially risky when permission changes are written to the Redis cache and subsequently used to authorize administrative operations.
The issue affects deployments where authenticated users can reach the role-permission API and where authorization checks do not adequately restrict which roles or permissions they may modify. It becomes especially risky when permission changes are written to the Redis cache and subsequently used to authorize administrative operations.
Exploit preconditions
- Attack surface: The authenticated REST endpoint
PUT /api/v1/roles/{roleId}/menus - Required access: A valid authenticated account with access to the role menu-permission operation
- Trigger point: Submission of a role permission update followed by permission-cache refresh or reuse
- Why exploitation is possible: The application does not sufficiently verify that the caller is authorized to assign the requested permissions or modify the selected role
- Attack surface: The authenticated REST endpoint
PUT /api/v1/roles/{roleId}/menus - Required access: A valid authenticated account with access to the role menu-permission operation
- Trigger point: Submission of a role permission update followed by permission-cache refresh or reuse
- Why exploitation is possible: The application does not sufficiently verify that the caller is authorized to assign the requested permissions or modify the selected role
Why this happens
The vulnerability results from enforcing authentication without enforcing authorization for a sensitive role-permission operation. The endpoint accepts permission changes based on the caller's authenticated identity but fails to perform an effective server-side access-control decision for the target role and requested privileges. This maps to CWE-862: Missing Authorization, where a protected function or resource lacks a required authorization check.
The vulnerability results from enforcing authentication without enforcing authorization for a sensitive role-permission operation. The endpoint accepts permission changes based on the caller's authenticated identity but fails to perform an effective server-side access-control decision for the target role and requested privileges. This maps to CWE-862: Missing Authorization, where a protected function or resource lacks a required authorization check.
Potential impact
- An authenticated low-privileged user may escalate their effective privileges
- Attackers could gain access to administrative functions
- Unauthorized users may modify menus, buttons, or other role capabilities
- Sensitive data or management operations could become accessible
- The application could experience integrity loss through unauthorized configuration changes
- An authenticated low-privileged user may escalate their effective privileges
- Attackers could gain access to administrative functions
- Unauthorized users may modify menus, buttons, or other role capabilities
- Sensitive data or management operations could become accessible
- The application could experience integrity loss through unauthorized configuration changes
General mitigation guidance
Mitigation generally focuses on enforcing authorization at the server-side operation boundary rather than relying on authentication or client-side controls.
Common defensive patterns include:
- Apply explicit, deny-by-default authorization checks to role and permission management operations
- Verify that the caller may modify the specific target role and assign each requested permission
- Prevent ordinary users from granting administrative or higher-privilege capabilities
- Validate permission changes against a centrally managed allowlist and privilege hierarchy
- Treat Redis permission-cache updates as security-sensitive and invalidate or refresh them only after an authorized change
- Use least-privilege roles and separate administrative permission-management capabilities
- Record and review high-risk permission changes with audit logging and alerting
Mitigation generally focuses on enforcing authorization at the server-side operation boundary rather than relying on authentication or client-side controls.
Common defensive patterns include:
- Apply explicit, deny-by-default authorization checks to role and permission management operations
- Verify that the caller may modify the specific target role and assign each requested permission
- Prevent ordinary users from granting administrative or higher-privilege capabilities
- Validate permission changes against a centrally managed allowlist and privilege hierarchy
- Treat Redis permission-cache updates as security-sensitive and invalidate or refresh them only after an authorized change
- Use least-privilege roles and separate administrative permission-management capabilities
- Record and review high-risk permission changes with audit logging and alerting
How teams detect issues like this
Detection can combine code review, automated analysis, and runtime monitoring:
- Review every role, group, menu, and permission mutation endpoint for object-level and action-level authorization checks
- Search for controller or service methods that update permissions without a policy or privilege evaluation
- Test requests using low-privileged accounts against other roles and administrative permissions
- Verify that cache refresh behavior cannot extend newly assigned privileges beyond the caller's authority
- Enforce API security policies requiring authorization decisions for sensitive role-management operations
- Monitor audit logs for unexpected permission grants, administrative privilege changes, or unusual cache invalidations
- Automated security testing and code-review tools may help identify endpoints that authenticate users without validating authorization scope
Detection can combine code review, automated analysis, and runtime monitoring:
- Review every role, group, menu, and permission mutation endpoint for object-level and action-level authorization checks
- Search for controller or service methods that update permissions without a policy or privilege evaluation
- Test requests using low-privileged accounts against other roles and administrative permissions
- Verify that cache refresh behavior cannot extend newly assigned privileges beyond the caller's authority
- Enforce API security policies requiring authorization decisions for sensitive role-management operations
- Monitor audit logs for unexpected permission grants, administrative privilege changes, or unusual cache invalidations
- Automated security testing and code-review tools may help identify endpoints that authenticate users without validating authorization scope
