CVE-2025-10987
📋 TL;DR
This vulnerability allows remote attackers to bypass authorization controls in YunaiV yudao-cloud by manipulating the contactId parameter in the /crm/contact/transfer endpoint. Attackers can potentially transfer CRM contacts without proper permissions. Affected systems include YunaiV yudao-cloud installations up to version 2025.09.
💻 Affected Systems
- YunaiV yudao-cloud
📦 What is this software?
Yudao Cloud by Iocoder
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized users could transfer sensitive CRM contact data to malicious actors, leading to data theft, business disruption, or compliance violations.
Likely Case
Attackers with some system access could escalate privileges and manipulate CRM data they shouldn't have access to.
If Mitigated
With proper network segmentation and authentication controls, impact would be limited to authorized users only.
🎯 Exploit Status
Exploit has been publicly disclosed. Attack requires some level of access to the system but not proper authorization for the specific function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor was contacted but did not respond. Consider upgrading to versions after 2025.09 if available.
🔧 Temporary Workarounds
Block vulnerable endpoint
allRestrict access to the /crm/contact/transfer endpoint using web application firewall or network controls
Implement additional authorization checks
allAdd server-side authorization validation for contact transfer operations
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the vulnerable system
- Deploy web application firewall with custom rules to detect and block exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check if yudao-cloud version is 2025.09 or earlier and the /crm/contact/transfer endpoint is accessibleCheck Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Test if unauthorized users can successfully transfer contacts via the vulnerable endpoint📡 Detection & Monitoring
Log Indicators:
- Unusual contact transfer activities
- Failed authorization attempts on /crm/contact/transfer
- Multiple transfer requests from single user
Network Indicators:
- HTTP POST requests to /crm/contact/transfer with manipulated contactId parameters
SIEM Query:
source="web_server" AND (url="/crm/contact/transfer" AND method="POST") AND (user_role!="admin" OR auth_result="failed")