CVE-2025-55469 is a critical severity (9.8) incorrect access control flaw in youlai-boot v2.21.1, published 26 November 2025. The record says attackers can escalate privileges and reach the administrator backend. Check the project's issue for a fix and keep the backend off the internet.
What's affected
The record lists youlai-boot v2.21.1. The description reads: incorrect access control allows attackers to escalate privileges and access the Administrator backend. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which means network reachable, low complexity, no privileges and no user interaction, with high impact across the board.
The references are a public gist, the project's repository on Gitee and an issue on the project tracker. We did not confirm a fixed version from them, and the record does not name one. Read the issue and the project's releases to see whether a corrected build exists. Do not assume a newer version fixes it without that confirmation.
The CVE is not listed on the CISA KEV list.
How to check if you're exposed
- Find the version of youlai-boot you run. Look in the project's
pom.xmlfor the version, or in your build artifact name. - If you build from source, check the commit you built against the project's history on Gitee.
- Review which routes require authentication and role checks in your deployment, in particular anything under the admin backend path.
- Check whether the backend is reachable from outside your network, and from which addresses.
- Read access logs for admin requests from accounts that should not hold admin rights.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan. It is built for package manifests, so it will not see a standalone server or a PHP project you downloaded as a zip. For those, an asset inventory of what you run is the starting point.
What to do now
- Identify every deployment of youlai-boot v2.21.1, including internal tools and forks.
- Read the project's issue for this problem and the latest release notes.
- Upgrade to a release the maintainers say corrects the access control, once you have confirmed it.
- Until then, put the admin backend behind a VPN or an IP allow list, and do not expose it to the internet.
- Review user and role tables for accounts or role changes you cannot explain.
- Rotate credentials and tokens held by administrators if you see signs of misuse.
- Add tests that call admin endpoints as a normal user and expect a denial.
Why it matters
The classes are CWE-284 and CWE-863: improper access control and incorrect authorization. The server fails to check, at the right place, whether the caller may do what they asked. These flaws are common in admin interfaces because the front end hides buttons while the back end forgets to enforce the rule.
An admin backend is the most valuable target in a business application. Reaching it with no privileges means user data, configuration and often the ability to change how the system behaves. Because the record is brief, the exact route is not stated, and we do not guess at it.
Authorization belongs on the server for every request, not only on menu visibility. A test that tries each admin endpoint as an ordinary user is cheap and catches this whole class.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is a fixed version of youlai-boot available?
The record does not name one. Read the project's issue on Gitee and its releases, and confirm with the maintainers before you rely on any version.
How do I limit damage in the meantime?
Restrict the admin backend to a VPN or allow listed addresses, and review administrator accounts and recent role changes.
Sources
- https://gist.github.com/old6ma/d6e19c9efbe28431f4c27c063cc9cbb8 (listed in the CVE record)
- https://gitee.com/youlaiorg/youlai-boot (listed in the CVE record)
- https://gitee.com/youlaiorg/youlai-boot/issues/ICFCOK (listed in the CVE record)
- Safeguard Gold entry for CVE-2025-55469
Last reviewed: 18 October 2026.
