CVE-2026-2105

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A flaw has been found in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. The affected element is the function addDept/updateDept/deleteDept of the file dataset\repos\warehouse\src\main\java\com\yeqifu\sys\controller\DeptController.java of the component Department Management. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-266CWE-285

Affected software

No affected versions have been published.

Timeline

Published
Feb 7, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-210505.1Improper access control in SmartThingsKit prior to SMR Jul-2026 Release 1 allows local attackers to access sensitive information.CVE-2026-210515.1Incorrect default permissions in WLAN security prior to SMR Jul-2026 Release 1 allows local attackers to configure TencentWifiSecurity settiCVE-2026-210526.8Path traversal in SemClipboardService prior to SMR Jul-2026 Release 1 allows local privileged attackers to access files with system privilegCVE-2026-210535.1Improper input validation in Samsung Email prior to version 6.2.13.1 allows local attackers to create arbitrary files within the applicationCVE-2026-210546.9Improper export of android application components in InputSharing prior to version 2.7.01.4 allows local attackers to access sharing data.CVE-2026-210558.5Improper export of android application components in Bixby prior to version 4.0.70.8 allows local attackers to execute arbitrary commands wiCVE-2026-210564.8Improper authorization in Samsung Health prior to version 7.00.0.107 allows local attackers to access connected device information.CVE-2026-210576.8Improper input validation in Samsung Pass prior to version 5.2.10.3 allows local privileged attackers to write out-of-bounds memory.CVE-2026-210587.1Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' pCVE-2026-210597.1Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file CVE-2026-21068.8A vulnerability has been found in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. The impacted element is the function addNCVE-2026-210604.6Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attackers to access data across multiple user
CVE-2026-2105: High severity, CVSS 8.8 | Vulnix