CVE-2026-2077
Improper Authorization in Yeqifu RoleController Enables Remote Exploit
Publication date: 2026-02-07
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| yeqifu | warehouse | to 2025-10-06 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-2077 is a security vulnerability in the yeqifu warehouse application affecting the Role Management Handler component, specifically the addRole, updateRole, and deleteRole functions in RoleController.java.
The vulnerability arises because these role management endpoints lack proper authorization checks, allowing any authenticated user to create, update, or delete roles without permission verification.
This improper authorization flaw enables attackers with low privileges to escalate their privileges by creating new privileged roles, modifying existing roles, or deleting critical roles such as the admin role.
The attack can be launched remotely, and a proof-of-concept exploit has been publicly disclosed demonstrating how a low-privileged user can delete high-privilege roles.
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'This vulnerability can lead to broad privilege escalation within the affected system, allowing attackers to gain unauthorized administrative access.'}, {'type': 'paragraph', 'content': "Attackers can disrupt normal operations by deleting critical roles, creating unauthorized privileged roles, or modifying existing roles, which compromises the system's confidentiality, integrity, and availability."}, {'type': 'paragraph', 'content': 'Because the exploit can be performed remotely by any authenticated user, the risk of operational disruption and unauthorized access is significant.'}] [1, 2, 3]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring and testing the Role Management endpoints (addRole, updateRole, deleteRole) in the yeqifu warehouse application for improper authorization.'}, {'type': 'paragraph', 'content': 'Specifically, you can attempt to send POST requests to these endpoints as a low-privileged authenticated user to check if unauthorized role creation, modification, or deletion is possible.'}, {'type': 'paragraph', 'content': 'For example, to test deletion of a high-privilege role, you can use a command like:'}, {'type': 'list_item', 'content': "curl -X POST -d 'id=8' http://[target]/role/deleteRole -b cookies.txt"}, {'type': 'paragraph', 'content': "Here, 'id=8' represents the admin role ID, and 'cookies.txt' contains authentication cookies for a low-privileged user. If the request succeeds in deleting the admin role, the vulnerability is present."}, {'type': 'paragraph', 'content': 'Similarly, you can test addRole and updateRole endpoints by sending POST requests with role data payloads without proper authorization checks.'}] [1, 3]
What immediate steps should I take to mitigate this vulnerability?
Currently, no official patches or countermeasures have been provided by the yeqifu warehouse project.
Immediate mitigation steps include:
- Restrict access to the Role Management endpoints (addRole, updateRole, deleteRole) to only trusted and highly privileged users via network controls or application firewall rules.
- Implement additional authorization checks at the application or proxy level to prevent unauthorized role manipulation.
- Monitor logs and alerts for suspicious activity related to role management operations.
- Consider replacing or disabling the affected Role Management Handler component if feasible.
Long term, await official patches or updates from the project or consider alternative products that do not have this vulnerability.