The vulnerability is an improper access control flaw in yeqifu’s Inport endpoint, specifically in the addInport, updateInport, and deleteInport functions. An attacker can remotely send HTTP requests to these endpoints and bypass authentication checks, allowing them to delete or modify inventory data without authorization. The flaw aligns with CWE‑266 and CWE‑284, undermining data integrity and potentially disrupting warehouse operations.

Yeqifu warehouse, an open‑source inventory management system hosted at github.com/yeqifu/warehouse. The affected code is present in all releases up to commit aaf29962ba407d22d991781de28796ee7b4670e4. Because the project employs a rolling‑release model, specific version numbers are not supplied; administrators should examine the commit history or query the GitHub repository for the latest fix.

The CVSS base score of 5.3 indicates moderate severity, and the EPSS score is below 1 % suggesting a very low probability of observed exploitation in the wild. The vulnerability is exploitable remotely via HTTP requests and is publicly disclosed, but no KEV listing indicates it has not yet been widely leveraged. While the risk remains moderate, the lack of a public patch and the potential for data loss warrant proactive mitigation. The likely attack vector is unauthorized remote access to the Inport endpoints without proper authentication.