The flaw originates in the saveUserRole function of the UserController, where role assignments are handled without adequate authorization checks. An attacker can craft a request to assign arbitrary roles to users, enabling privileged actions beyond their intended scope. This results in vertical privilege escalation, potentially compromising the entire system.

Yeqifu warehouse is affected in all releases up to commit aaf29962ba407d22d991781de28796ee7b4670e4. The project uses a rolling release model, so the exact version of a fixed release is not specified. All deployments of the software that include the vulnerable function are susceptible.

The CVSS score is 5.3, indicating moderate severity, while the EPSS score is less than 1%, suggesting a low probability of exploitation in the wild. The vulnerability can be triggered remotely by sending a specially crafted HTTP request to the /saveUserRole endpoint, and because the public exploit is available, an attacker could deploy this attack quickly.