CVE-2026-2850
Improper Access Control in Yeqifu Customer Endpoint Allows Remote Exploitation
Publication date: 2026-02-20
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| yeqifu | warehouse | to 2025-10-06 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-2850 is an improper access control vulnerability in the yeqifu warehouse application affecting the Customer Endpoint component. Specifically, the functions addCustomer, updateCustomer, and deleteCustomer in CustomerController.java do not enforce proper authorization checks.
This means that any authenticated user can remotely perform operations to add, update, or delete customer data without the necessary permissions or role-based access control.
The lack of permission enforcement allows unauthorized manipulation of critical business data, which can compromise data integrity and system security.
How can this vulnerability impact me? :
This vulnerability allows any logged-in user to perform unauthorized operations on critical business data such as customers, providers, and goods.
- Loss of data integrity due to unauthorized creation, modification, or deletion of records.
- Potential creation of fraudulent or malicious records that could disrupt business operations.
- Operational disruptions caused by unauthorized data manipulation.
Since the exploit is publicly available and remote exploitation is possible, attackers can easily abuse this vulnerability to compromise the system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring unauthorized access or manipulation attempts on the customer, provider, and goods CRUD endpoints of the yeqifu warehouse application, specifically targeting the addCustomer, updateCustomer, and deleteCustomer functions in CustomerController.java and similar functions in ProviderController.java and GoodsController.java.'}, {'type': 'paragraph', 'content': 'A practical detection method is to look for HTTP requests that perform add, update, or delete operations on these endpoints without proper authorization checks.'}, {'type': 'paragraph', 'content': 'For example, you can use network monitoring tools or web server logs to identify suspicious POST requests to endpoints like `/goods/deleteGoods` with parameters such as `id` and a valid session cookie, which indicate potential exploitation attempts.'}, {'type': 'paragraph', 'content': 'Suggested commands to detect such activity include using curl or similar tools to test authorization enforcement manually, or using grep on server logs to find unauthorized access patterns.'}, {'type': 'list_item', 'content': "grep 'POST /goods/deleteGoods' /var/log/nginx/access.log"}, {'type': 'list_item', 'content': "grep 'POST /customer/addCustomer' /var/log/nginx/access.log"}, {'type': 'list_item', 'content': "curl -X POST -b 'session=valid_session_cookie' https://yourserver/goods/deleteGoods -d 'id=10'"}, {'type': 'paragraph', 'content': 'These commands help identify if unauthorized users can perform critical operations without proper permissions.'}] [2]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'Immediate mitigation steps include implementing strict role-based access control (RBAC) on all CRUD endpoints related to customers, providers, and goods.'}, {'type': 'paragraph', 'content': "Ensure that each action (add, update, delete) verifies the user's permissions and ownership before allowing the operation to proceed."}, {'type': 'paragraph', 'content': 'If modifying the source code is possible, add authorization checks in the affected functions: addCustomer, updateCustomer, deleteCustomer in CustomerController.java, and similarly in ProviderController.java and GoodsController.java.'}, {'type': 'paragraph', 'content': 'If immediate code changes are not feasible, consider restricting access to these endpoints via network-level controls such as firewall rules or API gateways that enforce authentication and authorization.'}, {'type': 'paragraph', 'content': 'Monitor logs for suspicious activity and revoke or limit user sessions that may be abusing these endpoints.'}, {'type': 'paragraph', 'content': 'Since no official patch or fix is currently available, consider replacing or isolating the affected component until proper access controls are implemented.'}] [1, 3]