A critical authorization bypass vulnerability in youlai-boot version 2.21.1 allows authenticated users to import unauthorized user data into the system database.

The vulnerability exists within the importUsers function in SysUserController.java. It lacks a mandatory permission check for the current user, which permits any authenticated user to perform administrative-level data imports.

The ability for regular users to inject or overwrite user data poses a significant risk to data integrity and system security. With a CVSS score of 7.1, this high-severity flaw could lead to unauthorized account creation or the compromise of sensitive user information, potentially resulting in regulatory non-compliance and loss of system trust.

Immediate Action: Update the youlai-boot application to the version containing the fix provided in the vendor commit 9197065102f92264ded814a9d3e9f2a4ff0da121.

Proactive Monitoring: Review application access logs for unusual activity surrounding the user import functionality, specifically identifying imports initiated by accounts without administrative privileges.

Compensating Controls: Implement strict API gateway controls or network-level restrictions to limit access to the importUsers endpoint to verified administrative roles until the patch is applied.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub Gist referenced by the vulnerability record.

Given the high impact on data integrity and the availability of a public proof-of-concept, organizations running youlai-boot 2.21.1 must prioritize remediation. Administrators should verify their current version and apply the upstream fix immediately to prevent potential unauthorized data manipulation by authenticated users.