A flaw has been discovered in the Department Management component of yeqifu warehouse, specifically in the addDept, updateDept and deleteDept functions of DeptController.java. The logic fails to enforce proper authorization, enabling an attacker to execute department modifications or deletions that should be restricted to privileged users. This flaw is classified as a permissions‑based weakness (CWE‑266) and an authorization control weakness (CWE‑285). The consequence is the potential compromise of department data integrity and a possible elevation of privileges if the attacker gains access to the affected operations.

The vulnerability affects all releases of yeqifu warehouse up to the commit aaf29962ba407d22d991781de28796ee7b4670e4. Because the project follows rolling releases and does not publish explicit version numbers, any current deployment may still contain the insecure code until a fix is applied.

With a CVSS score of 5.3 the vulnerability presents a medium severity risk. The EPSS score is below 1 %, indicating a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. An attacker can launch the exploit remotely, as the flaws reside in publicly exposed API endpoints. Exploitation would require sending crafted requests to the deleteDept (or add/updateDept) routes; no additional conditions such as privileged network access are documented. The risk is moderate given the medium CVSS base, but the low exploitation likelihood and absence from KEV temper urgency. Prompt remediation is recommended however, because improper authorization can lead to data loss or an attacker's wider access within the system.