YunaiV yudao-cloud Improper Authorization Vulnerability in Business Transfer Function

An improper authorization vulnerability has been identified in YunaiV yudao-cloud versions prior to 2025.09. This vulnerability affects an unknown part of the file '/crm/business/transfer'. Manipulating the 'ids/newOwnerUserId' argument can lead to unauthorized actions. The vulnerability can be exploited remotely, and a public proof-of-concept exploit is available.

Impact

Exploitation of this vulnerability allows for improper authorization, enabling users to perform actions or access resources without the necessary permissions.

Reproduction

To reproduce this vulnerability, log in with a user account that has the 'crm:business:update' permission. Identify a business ID that belongs to another user and a new owner ID, which can be your own user ID. Then, send an HTTP request that includes the manipulated 'ids/newOwnerUserId' argument to the '/crm/business/transfer' endpoint.