A vulnerability in the Log Info Handler of the yeqifu warehouse application allows remote actors to invoke the batchDeleteLoginfo endpoint without proper authorization checks. The flaw permits arbitrary removal of log records, undermining data integrity and audit trails. The weakness is classified under CWE‑266 and CWE‑285, indicating inadequate privilege management and authorization enforcement.

The issue affects the yeqifu:warehouse component, specifically the LoginfoController.java integration that handles log deletion functions. Version information is unavailable because the project does not expose releases; therefore the vulnerability may be present in any deployed instance of this code base until a fix is applied.

The CVSS score of 5.3 marks this as a medium severity issue, and the EPSS score of less than 1% suggests a low current exploitation probability, yet the publicly available exploit means that an attacker could trigger the flaw remotely if the endpoint is reachable. Since the vulnerability directly bypasses authentication checks, successful exploitation results in unauthorized data deletion and potential denial of audit-related services. No indication that it appears in the KEV catalog means no confirmed widespread exploitation at this time, but the presence of the flaw warrants prompt patching or mitigation.