What’s Vulnerable › Vulnerabilities

CVE-2025-10275: YunaiV yudao-cloud transfer improper authorization

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-12 · updated 2026-10-27
• Weakness: CWE-266

Description

A weakness has been identified in YunaiV yudao-cloud up to 2025.09. This affects an unknown part of the file /crm/business/transfer. Executing a manipulation of the argument ids/newOwnerUserId can lead to improper authorization. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. It is recommended to upgrade the affected component. The vendor confirms: "[T]he current code already checks the functional update permission, uses the authenticated server-side user ID, requires CRM OWNER permission, and explicitly rejects non-owner transfers in the shared transfer service, except for authorized CRM administrators."

Affected products

• YunaiV yudao-cloud: through 2025.09
• YunaiV yudao-cloud: 2025.09

References

• https://vuldb.com/cve/CVE-2025-10275
• https://vuldb.com/submit/643384
• https://vuldb.com/vuln/323645
• https://vuldb.com/vuln/323645/cti
• https://www.cnblogs.com/aibot/p/19063574
• https://vuldb.com/?submit.643384

Get alerted when CVE-2025-10275 or the next vulnerability affects your stack