CVE-2026-0574
Improper Authorization in Yeqifu Warehouse Request Handler
Publication date: 2026-01-04
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| yeqifu | warehouse | to 2025-10-06 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an improper authorization flaw in the yeqifu warehouse software, specifically in the saveUserRole function of UserController.java. It allows a regular user to bypass authorization checks and assign themselves privileged roles, including administrator roles, by sending crafted requests remotely. This leads to vertical privilege escalation, granting unauthorized administrative control over the system. [2, 3]
How can this vulnerability impact me? :
Exploitation of this vulnerability can allow an attacker to gain full administrative control over the affected system. This compromises the confidentiality, integrity, and availability of the system by enabling unauthorized role assignments and potentially malicious actions performed with elevated privileges. [2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can involve monitoring for unauthorized role assignment requests to the affected saveUserRole function in UserController.java. Since the exploit is public and involves crafting malicious requests to assign privileged roles, network traffic analysis tools can be used to detect unusual POST or PUT requests to the role assignment endpoint. Specific commands are not provided in the resources, but inspecting HTTP request logs for unexpected role changes or using intrusion detection systems to flag privilege escalation attempts is recommended. [2, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the affected component, monitoring and auditing user role changes closely, and considering replacing the affected yeqifu warehouse component with an alternative product, as no known countermeasures or patches are currently available. Applying strict network controls to limit access to the vulnerable endpoint and increasing logging for suspicious activity are also advisable. [3]