Youlai-boot version 2.21.1 is vulnerable to an incorrect access control flaw that allows unauthenticated users to access restricted role information, posing a significant risk of privilege escalation.

The vulnerability exists in the getRoleForm function within SysRoleController.java, which lacks necessary permission checks. This failure allows unauthenticated attackers to query and view internal root-level role configurations.

The exposure of root-level role data provides attackers with critical insight into the administrative structure of the application. This information facilitates further targeted attacks, potentially leading to full account takeover or unauthorized administrative actions. With a CVSS score of 7.5, this high-severity flaw represents a significant risk to data confidentiality and internal system integrity.

Immediate Action: Review the provided commit history on the vendor repository and apply the necessary code-level access control restrictions to the getRoleForm function.

Proactive Monitoring: Monitor application access logs for unusual patterns of requests directed at the SysRoleController endpoint, specifically looking for unauthorized attempts to retrieve role metadata.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or challenge requests to the identified vulnerable API endpoint until a formal patch can be deployed.

Public Exploit Available: Yes, a public proof-of-concept exists via the linked GitHub Gist.

Given the high CVSS score and the existence of a public proof-of-concept, organizations running youlai-boot version 2.21.1 must prioritize remediation. Verify your environment against the affected version and apply the logic fix identified in the vendor commit history immediately to prevent unauthorized exposure of sensitive administrative roles.