Youlai Boot Improper Access Control Vulnerability Allowing Unauthorized Role Access

A vulnerability exists in Youlai Boot version 2.21.1 due to incorrect access control in the SysRoleController.java file. The getRoleForm function fails to implement proper permission checks, potentially allowing non-root users to access root roles directly. This issue arises because the function does not verify whether the current user has the right to access specific role information, enabling unauthorized access by simply inputting a role ID.

Impact

Exploitation of this vulnerability could lead to unauthorized access to role information, allowing users to gain privileges or access rights they should not have.

Remediation

Users can update to Youlai Boot version 3.2.0 or later, where this vulnerability has been fixed.