youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/{userId}/status to disable root or admin accounts, locking administrators out, or re-enable accounts an administrator has disabled.
Get the CyboWatch SIEM platform, hosting, and 24×7 SOC analysts. Send an enquiry, or call or email us to get started.