CVE-2025-55469

Incorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges and access the Administrator backend.

• CWE-863
• CWE-284

• https://gist.github.com/old6ma/d6e19c9efbe28431f4c27c063cc9cbb8Third Party Advisory
• https://gitee.com/youlaiorg/youlai-bootProduct
• https://gitee.com/youlaiorg/youlai-boot/issues/ICFCOKExploit, Issue Tracking, Vendor Advisory
• https://gitee.com/youlaiorg/youlai-boot/issues/ICFCOKExploit, Issue Tracking, Vendor Advisory

Published

Nov 26, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-55449AstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Resp…7.3
• CVE-2025-5545A vulnerability classified as problematic has been found in …7.5
• CVE-2025-55454An authenticated arbitrary file upload vulnerability in the …8.8
• CVE-2025-55455DooTask v1.0.51 was dicovered to contain an authenticated ar…3.5
• CVE-2025-5546A vulnerability classified as critical was found in PHPGuruk…8.8
• CVE-2025-55462A CORS misconfiguration in Eramba Community and Enterprise E…6.5
• CVE-2025-5547A vulnerability, which was classified as critical, has been …9.8
• CVE-2025-55471Incorrect access control in the getUserFormData function of …7.5
• CVE-2025-55472SQL Injection vulnerability exists in Tirreno v0.9.5, specif…6.5
• CVE-2025-55473Asian Arts Talents Foundation (AATF) Website v5.1.x and Dock…6.1
• CVE-2025-55474Many Notes 0.10.1 is vulnerable to Cross Site Scripting (XSS…6.1
• CVE-2025-55476FireShare FileShare 1.2.25 contains a time-based blind SQL i…6.5