Description
A security flaw has been discovered in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. Affected is the function saveRolePermission of the file dataset\repos\warehouse\src\main\java\com\yeqifu\sys\controller\RoleController.java of the component Role-Permission Binding Handler. The manipulation results in improper access controls. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-02-07
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Access via Improper Role Permission Binding
Action: Patch Immediately
AI Analysis

Impact

The vulnerability lies in the saveRolePermission method of Yeqifu Warehouse's Role-Permission Binding Handler. Incorrect access controls permit an attacker to freely modify role-to-permission mappings, effectively granting themselves elevated privileges or unauthorized access to protected resources. This flaw is classified as a privilege escalation issue rooted in CWE-266 and CWE-284.

Affected Systems

The affected product is Yeqifu Warehouse. Version information is not disclosed because the project follows a rolling release model; affected versions include all releases up to commit aaf29962ba407d22d991781de28796ee7b4670e4.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% reflects a low yet non-zero threat of exploitation. The vulnerability is not listed in CISA's KEV catalog, and public exploit code has already been released, allowing attackers to exploit the bug remotely by accessing the vulnerable endpoint.

Generated by OpenCVE AI on April 17, 2026 at 22:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Yeqifu Warehouse release that contains the fixed Role-Permission Binding logic.
  • If an update is unavailable, restrict access to the RoleController endpoint so that only authenticated administrators can invoke saveRolePermission.
  • Continuously monitor audit logs for unauthorized role‑permission changes and enforce strict role‑based access controls.

Generated by OpenCVE AI on April 17, 2026 at 22:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Feb 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 10 Feb 2026 15:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:yeqifu:warehouse:*:*:*:*:*:*:*:*

Mon, 09 Feb 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Yeqifu
Yeqifu warehouse
Vendors & Products Yeqifu
Yeqifu warehouse

Sat, 07 Feb 2026 05:30:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. Affected is the function saveRolePermission of the file dataset\repos\warehouse\src\main\java\com\yeqifu\sys\controller\RoleController.java of the component Role-Permission Binding Handler. The manipulation results in improper access controls. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
Title yeqifu warehouse Role-Permission Binding RoleController.java saveRolePermission access control
Weaknesses CWE-266
CWE-284
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Yeqifu Warehouse
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T09:29:40.331Z

Reserved: 2026-02-06T07:50:14.598Z

Link: CVE-2026-2075

cve-icon Vulnrichment

Updated: 2026-02-10T15:26:37.929Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-07T06:16:04.120

Modified: 2026-02-10T15:15:22.390

Link: CVE-2026-2075

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T22:15:29Z

Weaknesses