PermissionController in the Warehouse application lacks proper authorization enforcement for addPermission, updatePermission, and deletePermission functions. An attacker can invoke deletePermission without being verified against a permission store, thereby erasing critical access controls. This flaw falls under improper authorization (CWE-266, CWE-285) and can lead to the loss of legitimate access rights and potential privilege escalation or denial of service for authorized users.

All releases of the yeqifu Warehouse application that include the code before commit aaf29962ba407d22d991781de28796ee7b4670e4 are affected. Because the project follows a rolling release model, no specific version numbers are published for fixes, so any deployed instance that has not applied a newer commit is vulnerable.

The CVSS score of 5.3 indicates moderate severity, while an EPSS score of less than 1% suggests the attack is unlikely to be widely executed at this time. The vulnerability can be triggered remotely, and exploit code is publicly available. The flaw is not listed in the CISA KEV catalog, implying that it has not yet seen widespread exploitation. However, the lack of a strict authorization check on a privileged endpoint makes it an appealing target for attackers who can delete or manipulate permissions, potentially facilitating further escalation or disruption if the application is exposed to untrusted networks.