CVE-2026-7672 | youlaitech youlai-boot up to 2.21.1 Users Endpoint UserController.java getUserList order sql injection (EUVD-2026-26805)

A vulnerability, which was classified as critical, was found in youlaitech youlai-boot up to 2.21.1. This affects the function getUserList of the file src/main/java/com/youlai/boot/system/controller/UserController.java of the component Users Endpoint. Such manipulation of the argument order leads to sql injection.

This vulnerability is traded as CVE-2026-7672. The attack may be launched remotely. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure but did not respond in any way.