Youlai Boot Improper Access Control Vulnerability in User Data Retrieval Function

A vulnerability exists in Youlai Boot version 2.21.1 prior to 3.2.0, allowing users to access sensitive information of other users due to incorrect access control in the 'getUserFormData' function. The issue arises because the function does not perform necessary permission checks, enabling users to retrieve data by inputting another user's ID.

Impact

Exploitation of this vulnerability allows unauthorized access to other users' sensitive information.

Reproduction

The vulnerability can be reproduced by logging in as a user with limited access rights and using the 'getUserForm' API endpoint. By altering the user ID parameter, it is possible to access the form data of other users, bypassing the lack of authorization checks.

Remediation

It is recommended to implement proper authorization checks in the 'getUserFormData' function to ensure that users can only access their own information.