# CVE-2026-116016: yudao-cloud authorization bypass in row-level data scope

Source: https://junglewise.ai/threats/cve-2026-116016-yudao-cloud-through-2026-09-contains-an-authorization-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-24. Updated: 2026-10-24  
License: CC BY 4.0 with a link back

CVE-2026-116016 · Severity: high · CVSS 7.1 · Published 2026-10-24

yudao-cloud is a backend application framework for building multi-tenant business systems. An authenticated user can bypass row-level data access controls by sending a specially crafted HTTP header, allowing them to read or modify data belonging to other departments and users within the same tenant.

Technologies: [YunaiV Yudao-Cloud](https://junglewise.ai/threats/technologies/yudao-cloud). Vendors: [YunaiV](https://junglewise.ai/threats/vendors/yunaiv).

## Quick answers

**Is CVE-2026-116016 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116016 being exploited in the wild.

**How severe is CVE-2026-116016?** High severity, with a CVSS score of 7.1, published 24 October 2026.

**Which products and versions are affected?** YunaiV Yudao-Cloud through 2026.09.

**Is there a fix for CVE-2026-116016?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-116016 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-116016?** Check whether you run YunaiV Yudao-Cloud at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authorization bypass exists in DataPermissionRpcWebFilter, which checks for a header named "data-permission-enable" set to "false" and trusts this value to disable row-level access controls. Authenticated attackers can add this header to /admin-api requests to bypass scope restrictions and access or modify restricted records. The vulnerability affects all versions through 2026.09.

## Affected products

- YunaiV yudao-cloud through 2026.09

## Timeline

- 2026-10-24: disclosed

## References

- [https://github.com/YunaiV/yudao-cloud/blob/d322a10b9898a084412032e94336af06835978c2/yudao-framework/yudao-spring-boot-starter-biz-data-permission/src/main/java/cn/iocoder/yudao/framework/datapermission/core/rpc/DataPermissionRpcWebFilter.java](https://github.com/YunaiV/yudao-cloud/blob/d322a10b9898a084412032e94336af06835978c2/yudao-framework/yudao-spring-boot-starter-biz-data-permission/src/main/java/cn/iocoder/yudao/framework/datapermission/core/rpc/DataPermissionRpcWebFilter.java)
- [https://github.com/YunaiV/yudao-cloud/blob/d322a10b9898a084412032e94336af06835978c2/yudao-gateway/src/main/java/cn/iocoder/yudao/gateway/filter/security/TokenAuthenticationFilter.java](https://github.com/YunaiV/yudao-cloud/blob/d322a10b9898a084412032e94336af06835978c2/yudao-gateway/src/main/java/cn/iocoder/yudao/gateway/filter/security/TokenAuthenticationFilter.java)

## Related threats

- [yudao-cloud insecure direct object reference in trade module](https://junglewise.ai/threats/cve-2026-116015-yudao-cloud-through-2026-09-contains-an-insecure-direct-object)
- [YunaiV yudao-cloud broken access control in BPM module](https://junglewise.ai/threats/cve-2026-58448-yunaiv-yudao-cloud-broken-access-control-in-bpm-module)
- [YunaiV yudao-cloud SSRF in IoT Admin API](https://junglewise.ai/threats/cve-2026-9464-yunaiv-yudao-cloud-ssrf-in-iot-admin-api)
- [YunaiV yudao-cloud SSRF in Business Process Management component](https://junglewise.ai/threats/cve-2025-15098-yunaiv-yudao-cloud-ssrf-in-business-process-management-component)