The Warehouse project contains an authorization flaw in CustomerController’s addCustomer, updateCustomer and deleteCustomer actions. The module does not enforce proper permission checks, allowing any remote user to invoke these endpoints and alter or delete customer data. This results in an improper access control vulnerability that can lead to unauthorized manipulation of sensitive customer information.

Yeqifu Warehouse, a web application component exposed via REST endpoints. No specific release or version is affected; the product uses a rolling release model and the upstream repository does not list a patched commit yet.

The CVSS score of 5.3 reflects a moderate level of risk, while the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalogue. Remote exploitation is possible through unauthenticated or weakly authenticated HTTP requests to the Customer API. A publicly available exploit demonstrates that an attacker can send a crafted request to the deleteCustomer endpoint and permanently erase customer records, highlighting that any user with network access to the service can exercise this flaw.