CVE-2025-10987: Iocoder Yudao-cloud Auth Bypass Flaw

CVE-2025-10987 Overview

CVE-2025-10987 is an improper authorization vulnerability [CWE-266] in YunaiV yudao-cloud versions up to 2025.09. The flaw resides in the HTTP request handler for the /crm/contact/transfer endpoint, where the contactId argument is processed without sufficient authorization checks. An authenticated remote attacker can manipulate this parameter to perform contact transfer actions outside their permitted scope. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse. The vendor was contacted prior to public disclosure but did not respond.

Critical Impact
Authenticated remote attackers can manipulate the contactId parameter on /crm/contact/transfer to bypass authorization controls and affect CRM contact ownership data belonging to other tenants or users.

Affected Products

YunaiV yudao-cloud versions up to and including 2025.09
CRM module exposing the /crm/contact/transfer HTTP endpoint
Deployments where the contactId parameter is accepted without per-user authorization validation

Discovery Timeline

2025-09-26 - CVE-2025-10987 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-10987

Vulnerability Analysis

The vulnerability is classified under [CWE-266] Incorrect Privilege Assignment. The /crm/contact/transfer endpoint accepts a contactId argument and processes the transfer operation without enforcing that the requesting user owns or has rights over the targeted contact record. An authenticated attacker with low-level privileges can submit crafted requests referencing arbitrary contactId values to reassign CRM contacts they should not be able to modify. The attack requires network access to the application but no user interaction. Confidentiality, integrity, and availability impacts are limited in scope according to the published CVSS vector. Public disclosure of exploitation details lowers the barrier for adversaries to reproduce the attack.

Root Cause

The root cause is missing or insufficient authorization logic in the request handler for /crm/contact/transfer. The application authenticates the session but fails to verify that the caller is permitted to act on the supplied contactId. This breaks the principle of least privilege and allows horizontal privilege escalation between users or tenants of the CRM module.

Attack Vector

Exploitation is performed remotely over HTTP by an authenticated user holding at least minimal application privileges. The attacker issues a request to /crm/contact/transfer with a contactId value referencing a record outside their authorized data scope. Because the endpoint does not validate ownership, the transfer operation proceeds. No additional user interaction or social engineering is required. Refer to the VulDB advisory #325910 and the CNBlogs Security Post for additional technical context.

Detection Methods for CVE-2025-10987

Indicators of Compromise

HTTP POST requests to /crm/contact/transfer containing contactId values not associated with the authenticated user's normal data scope
Unexpected ownership changes on CRM contact records that cannot be tied to legitimate administrative activity
High volume of sequential or enumerated contactId values originating from a single session or IP address

Detection Strategies

Correlate application audit logs of contact transfer operations against the requesting user's permission scope to identify out-of-scope changes
Deploy WAF or API gateway rules that log all calls to /crm/contact/transfer and flag anomalous parameter patterns
Implement database-level triggers or change auditing on the CRM contacts table to record ownership modifications with timestamps and acting user IDs

Monitoring Recommendations

Continuously monitor authentication and authorization decisions for the /crm/* endpoint family, alerting on access-denied bypass patterns
Track baseline rates of contact transfer operations per user and alert on deviations
Review application logs for repeated 200 OK responses to /crm/contact/transfer from accounts that historically perform no transfer activity

How to Mitigate CVE-2025-10987

Immediate Actions Required

Restrict network exposure of the yudao-cloud CRM module to trusted users only until a fix is applied
Implement compensating authorization checks at a reverse proxy or API gateway layer that validate contactId ownership before forwarding requests
Audit recent contact transfer activity for unauthorized ownership changes and revert as needed
Rotate session tokens and review user privilege assignments within the CRM module

Patch Information

No vendor advisory or official patch has been published. The vendor did not respond to the disclosure attempt according to the public CVE record. Organizations should monitor the upstream yudao-cloud repository for updates beyond version 2025.09 and apply security fixes as they become available. Track the VulDB CTI entry #325910 for status changes.

Workarounds

Add server-side authorization middleware that verifies the authenticated user's ownership of the contactId before allowing transfer operations
Block or restrict access to /crm/contact/transfer at the WAF or load balancer level for non-administrative roles until the application is patched
Apply principle-of-least-privilege role configurations so that only designated CRM administrators can invoke transfer functionality

bash

# Example Nginx rule restricting /crm/contact/transfer to internal admin network
location /crm/contact/transfer {
    allow 10.0.0.0/24;   # admin subnet
    deny  all;
    proxy_pass http://yudao_backend;
}