CVE-2026-2106

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability has been found in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. The impacted element is the function addNotice/updateNotice/deleteNotice/batchDeleteNotice of the file dataset\repos\warehouse\src\main\java\com\yeqifu\sys\controller\NoticeController.java of the component Notice Management. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-266 CWE-285

Affected software

Vendor	Product	Versions
yeqifu	warehouse	aaf29962ba407d22d991781de28796ee7b4670e4

References

https://github.com/yeqifu/warehouse/Product
https://github.com/yeqifu/warehouse/issues/58Exploit, Issue Tracking, Vendor Advisory
https://github.com/yeqifu/warehouse/issues/58#issue-3846664260Exploit, Issue Tracking, Vendor Advisory
https://vuldb.com/?ctiid.344682Permissions Required, VDB Entry
https://vuldb.com/?id.344682Third Party Advisory, VDB Entry
https://vuldb.com/?submit.745516Third Party Advisory, VDB Entry

Timeline

Published: Feb 7, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-210604.6Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attackers to access data across multiple user CVE-2026-210616.5Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions. User in CVE-2026-210623.3Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard data.CVE-2026-210636.1Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers to bypass app lock fu CVE-2026-210645.5Improper access control in Weaver prior to SMR Aug-2026 Release 1 allows local attackers to cause device inoperability.CVE-2026-210657.8Out-of-bounds write in libcodec2secqcelpdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.CVE-2026-210667.8Improper input validation in libcodec2_sec_flacdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.CVE-2026-210677.8Improper input validation in libsmsd.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.CVE-2026-210687.8Stack-based buffer overflow in libril_sem.so prior to SMR Aug-2026 Release 1 allows privileged local attackers to execute arbitrary code.CVE-2026-210697.8Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-CVE-2026-21078.8A vulnerability was found in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This affects the function loadAllLoginfo/delet CVE-2026-210704.6Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information.