Description
A vulnerability was detected in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This affects the function addPermission/updatePermission/deletePermission of the file dataset\repos\warehouse\src\main\java\com\yeqifu\sys\controller\PermissionController.java of the component Permission Management. Performing a manipulation results in improper authorization. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Metrics
CVSS 3.1 8.8/10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| yeqifu | warehouse | aaf29962ba407d22d991781de28796ee7b4670e4 |
References
- https://github.com/yeqifu/warehouse/Product
- https://github.com/yeqifu/warehouse/issues/55Exploit, Issue Tracking, Vendor Advisory
- https://github.com/yeqifu/warehouse/issues/55#issue-3846656775Exploit, Issue Tracking, Vendor Advisory
- https://vuldb.com/?ctiid.344644Permissions Required, VDB Entry
- https://vuldb.com/?id.344644Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.745513Third Party Advisory, VDB Entry
Timeline
- Published
- Feb 7, 2026
- Last modified
- Jun 17, 2026
- NVD status
- Analyzed