The vulnerability arises from missing access controls in the CacheController module that handles cache deletion, purging, and synchronization. An attacker who can reach these endpoints may trigger cache operations without authentication, potentially leading to data loss, service disruption, or exposure of sensitive cache contents. The impact is limited to the cache layer but can affect system stability and data availability, as the underlying data may be invalidated or removed. This flaw does not provide arbitrary code execution but allows direct manipulation of cached data across the application.

The affected product is yeqifu's Warehouse, a rolling‑release repository management system hosted on GitHub. No specific version numbers are available, but any release built before the commit aaf29962ba407d22d991781de28796ee7b4670e4 contains the vulnerable code.

The entry carries a CVSS score of 5.3, indicating moderate severity. The EPSS score is below 1 %, implying a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalogue, so no confirmed widespread exploitation has been reported. Attackers would need to discover and gain network access to the application, then issue the delete, purge, or sync requests. With no remediation detected once this analysis was written, the risk remains moderate until a patch or workaround is deployed.