---
id: CVE-2025-10275
title: YunaiV yudao-cloud transfer improper authorization
summary: >-
  A weakness has been identified in YunaiV yudao-cloud up to 2025.09. This
  affects an unknown part of the file /crm/business/transfer. Executing a
  manipulation of the argument ids/newOwnerUserId can lead to improper
  authorization. The atta…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-285
  - CWE-266
vendor: YunaiV
product: yudao-cloud
affected:
  - yudao-cloud 2025.09
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-09-12T13:09:25.536290Z'
exploitAvailable: true
published: '2025-09-12'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T07:04:10.761Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-10275'
references:
  - url: 'https://vuldb.com/vuln/323645'
    label: VDB-323645 | YunaiV yudao-cloud transfer improper authorization
  - url: 'https://vuldb.com/vuln/323645/cti'
    label: 'VDB-323645 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2025-10275'
    label: CVE-2025-10275 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/643384'
    label: >-
      Submit #643384 | yunaiv yudao-cloud latest broken function level
      authorization
  - url: 'https://www.cnblogs.com/aibot/p/19063574'
tags:
  - cve.org
  - exploit-available
epss: 0.00303
epssPercentile: 0.2291
ingestedAt: '2026-10-27T16:11:59.234Z'
---

## Overview

A weakness has been identified in YunaiV yudao-cloud up to 2025.09. This affects an unknown part of the file /crm/business/transfer. Executing a manipulation of the argument ids/newOwnerUserId can lead to improper authorization. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. It is recommended to upgrade the affected component. The vendor confirms: "[T]he current code already checks the functional update permission, uses the authenticated server-side user ID, requires CRM OWNER permission, and explicitly rejects non-owner transfers in the shared transfer service, except for authorized CRM administrators."

## Affected

- `yudao-cloud 2025.09`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.