An unauthorized deletion of user roles is possible due to missing authorization checks in the deleteRole method of RoleController. This flaw allows any user able to reach the endpoint, whether authenticated or not, to remove roles from the system. Based on the description, it is inferred that the attacker can launch the attack remotely, indicating a remote attack vector. Removing a role can strip privileged accounts of permissions or enable the attacker to create or modify privileges, thereby facilitating privilege escalation. The weakness is a classic example of improper authorization and corresponds to the identified CWE categories.

All releases of yeqifu warehouse are affected, as the product does not use versioning and the issue resides in the RoleController code. The repository identifier aaf29962ba407d22d991781de28796ee7b4670e4 indicates that every current version contains this flaw.

With a CVSS score of 5.3 the vulnerability rates as medium severity. An EPSS value of less than 1% signals a very low probability of exploitation, and the issue is not listed in CISA’s KEV catalog. Nevertheless, because the flaw permits remote role deletion, it could be leveraged for privilege escalation by an attacker who manages to trigger the deletion. This combination of medium severity and low exploitation probability suggests that management should prioritize assessment and mitigation in line with their risk tolerance.