A flaw exists in the NoticeController of yeqifu warehouse that allows an attacker to delete notices, including multiple entries in a single operation, without proper authorization. The lack of authentication checks means any remote client that can reach the batchDeleteNotice endpoint can instruct the system to remove notices from the database. This leads to integrity violations and loss of legitimate information, potentially disrupting business processes. The weakness is an improper privilege management flaw (CWE-266) combined with an improper authorization issue (CWE-285).

YeQifu Warehouse, any deployment using the Notice Management component up to the commit aaf29962ba407d22d991781de28796ee7b4670e4, as the exact affected revision and updated releases are not publicly identified.

The CVSS base score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a very low current exploitation probability. It is not yet listed in the CISA KEV catalog. Attackers would need remote network access to the NoticeController API and could trigger the vulnerability using the batchDeleteNotice operation, bypassing any role checks. Given the modern continuous delivery of rolling releases, the absence of a patch and the vendor’s delayed response elevate concern for systems that remain exposed.