YunaiV yudao-cloud Improper Authorization Vulnerability in Receivable Submission

An improper authorization vulnerability has been identified in YunaiV yudao-cloud versions prior to 2025.09. The issue arises in the file '/crm/receivable/submit', where the manipulation of the 'ID' argument leads to unauthorized access. This vulnerability can be exploited remotely, and a public proof-of-concept exploit is available.

Impact

Exploitation of this vulnerability allows for broken function level authorization, enabling an attacker to access or manipulate resources or actions they are not authorized to.

Reproduction

To reproduce this vulnerability, log in with a user account that has the 'crm:receivable:update' permission. Identify a receivable ID that belongs to another user and has not yet been submitted for approval. Then, send an HTTP request to the '/crm/receivable/submit' endpoint, including the manipulated ID argument to exploit the improper authorization.