CVE-2025-10277 Overview
CVE-2025-10277 is an improper authorization vulnerability affecting YunaiV yudao-cloud versions up to 2025.09. The flaw resides in the /crm/receivable/submit endpoint, where manipulation of the ID argument allows authenticated attackers to bypass authorization controls. The vulnerability is exploitable remotely over the network and requires low privileges. Public exploit details are available, increasing the risk of opportunistic attempts. The vendor was contacted prior to disclosure but did not respond, leaving deployments without a coordinated vendor fix at publication time. The issue is tracked under [CWE-266: Incorrect Privilege Assignment].
Critical Impact
Authenticated remote attackers can manipulate the ID parameter on /crm/receivable/submit to perform actions outside their authorization boundary, affecting CRM receivable data integrity and confidentiality.
Affected Products
- iocoder yudao-cloud (versions up to 2025.09)
- YunaiV yudao-cloud CRM module
- Deployments exposing the /crm/receivable/submit endpoint
Discovery Timeline
- 2025-09-12 - CVE-2025-10277 published to the National Vulnerability Database
- 2026-04-29 - Last updated in NVD database
Technical Details for CVE-2025-10277
Vulnerability Analysis
The vulnerability affects the receivable submission workflow within the CRM module of yudao-cloud, an open-source Spring Cloud-based enterprise development platform. The /crm/receivable/submit handler accepts an ID parameter that identifies the target receivable record. The application fails to enforce ownership or role-based access checks against the supplied ID before processing the submission. As a result, an authenticated user can supply identifiers belonging to records they do not own and trigger backend state changes on those records.
The weakness is classified under [CWE-266], reflecting improper privilege assignment between authenticated sessions and protected resources. According to public disclosure tracked in VulDB #323647, exploitation details are public. Impact scope is limited to the receivable submission flow rather than broader system compromise, which aligns with the low confidentiality, integrity, and availability metrics in the CVSS 4.0 vector.
Root Cause
The root cause is a missing authorization check on the ID parameter passed to the receivable submit handler. The controller validates session authentication but does not validate that the authenticated principal has permission to act on the referenced receivable entity. This server-side authorization gap is a textbook Insecure Direct Object Reference (IDOR) pattern.
Attack Vector
An attacker requires a valid low-privilege account on the target yudao-cloud instance. The attacker issues an authenticated HTTP request to /crm/receivable/submit while substituting the ID parameter with a value referencing another tenant's or user's receivable record. Because the server processes the request without verifying ownership, the attacker influences the targeted record. No user interaction is needed and the attack is delivered over the network.
No verified proof-of-concept code is reproduced here. Technical details are available in the VulDB CTI entry and an associated CNBlogs security write-up.
Detection Methods for CVE-2025-10277
Indicators of Compromise
- Repeated POST requests to /crm/receivable/submit from a single authenticated session referencing many distinct ID values
- Submission events on receivable records owned by users different from the acting session principal
- Audit log entries where the actor user ID does not match the owner or assignee of the modified receivable
- HTTP 200 responses to /crm/receivable/submit followed by unexpected state changes in CRM receivable tables
Detection Strategies
- Instrument the /crm/receivable/submit endpoint with application-layer logging that records the acting user, the supplied ID, and the owner of the resolved record
- Build correlation rules that flag mismatches between actor identity and target record ownership across CRM endpoints
- Baseline normal receivable submission volume per user and alert on statistical outliers
Monitoring Recommendations
- Forward web server and application logs from yudao-cloud services to a centralized analytics platform for cross-session correlation
- Monitor authentication logs for accounts performing enumeration-like sequential or randomized ID access patterns
- Track database audit events on the CRM receivable tables to identify writes initiated by non-owner principals
How to Mitigate CVE-2025-10277
Immediate Actions Required
- Restrict access to the /crm/receivable/submit endpoint at the reverse proxy or API gateway to trusted internal networks where feasible
- Audit existing CRM receivable records for unauthorized modifications since the September 2025 disclosure window
- Review and tighten role-based access control configurations for CRM module accounts, reducing low-privilege account counts
- Enable verbose application logging on all CRM controllers to support post-incident forensics
Patch Information
At the time of NVD last modification on 2026-04-29, no official vendor patch advisory is referenced. The vendor did not respond to disclosure outreach. Operators should monitor the iocoder yudao-cloud project for upstream fixes and apply server-side authorization checks that validate the acting user's permission against the referenced receivable ID before processing the submission.
Workarounds
- Implement a web application firewall rule that inspects /crm/receivable/submit requests and enforces session-to-record ownership mapping where possible
- Add a custom Spring interceptor or filter that resolves the receivable owner from the ID parameter and rejects requests when the authenticated principal lacks rights
- Disable the receivable submit functionality for accounts that do not require it through CRM role configuration
- Place the yudao-cloud deployment behind an authenticated reverse proxy that adds per-tenant request scoping
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
