Authorization Bypass via Data Permission Header Manipulation

CVE-2026-116016 is an authorization bypass vulnerability in yudao-cloud that allows authenticated users to escalate privileges and access restricted data by manipulating HTTP headers. By sending a `data-permission-enable: false` header with requests to `/admin-api` endpoints, attackers can bypass row-level data scope restrictions designed to isolate records by department and user within a multi-tenant environment. This vulnerability affects organizations using yudao-cloud through version 2026.09 and is particularly dangerous because it requires only valid authentication—no additional exploitation steps are needed. The impact is severe: attackers can read, modify, or delete sensitive business data belonging to other departments or users, leading to data breaches, compliance violations, and potential lateral movement within the tenant infrastructure.

While this CVE maps to CWE-807 (Reliance on Untrusted Inputs in a Security Decision) rather than specific MITRE ATT&CK techniques, Casky's security skills would detect the attack patterns underlying this vulnerability through behavioral analysis. Practitioners using Casky would identify suspicious activity such as: unusual cross-department data access requests from single users, authorization decision logic that trusts client-supplied headers, and access patterns that violate expected row-level security boundaries. The platform's extended reasoning capabilities would flag the architectural flaw—that a web filter (DataPermissionRpcWebFilter) trusts a client-controllable header to disable security controls—as a critical design vulnerability. Detection findings would highlight the need for server-side authorization enforcement, header validation, and the principle of never allowing clients to disable security mechanisms.