CVE-2025-66736: Youlai Youlai-Boot

High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days.

youlai-boot V2.21.1 is vulnerable to Incorrect Access Control. The importUsers function in SysUserController.java does not perform a permission check on the current user's identity, which may allow regular users to import user data into the database, resulting in an authorization bypass vulnerability.

Affected products

• Youlai Youlai-Boot: version 2.21.1 only

Published 2025-12-22. Last modified 2026-06-17.