Executive Summary

CVE-2026-2851 is an improper access control vulnerability in the yeqifu warehouse application, specifically affecting the inventory management endpoints handled by InportController.java and OutportController.java.

The affected functions—addInport, updateInport, and deleteInport—do not enforce proper permission checks, allowing attackers to remotely perform unauthorized inventory operations such as forging inventory movements, adjusting stock quantities, or deleting inventory records.

This lack of authorization means attackers can manipulate inventory data arbitrarily without validation, leading to inaccurate stock levels and potential financial discrepancies.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have several negative impacts including inaccurate stock levels, financial discrepancies, and exploitation of procurement or return workflows.

• Attackers can forge inventory movements, adding or removing stock without authorization.
• Unauthorized adjustments to stock quantities can disrupt inventory management and reporting.
• Deletion of inventory records without permission can cause data loss and operational issues.

Overall, these impacts can compromise the integrity, availability, and reliability of inventory data, potentially leading to financial loss and operational disruption.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring unauthorized or suspicious requests to the inventory management endpoints, specifically the addInport, updateInport, and deleteInport functions of the InportController, as well as the addOutport and deleteOutport functions of the OutportController.'}, {'type': 'paragraph', 'content': 'One way to detect exploitation attempts is to look for POST requests to endpoints such as /inport/addInport with unusual or forged parameters, especially when accompanied by attacker-controlled session cookies.'}, {'type': 'paragraph', 'content': 'Suggested commands to detect such activity include using network traffic inspection tools or web server logs to filter for suspicious POST requests. For example, using grep on server logs:'}, {'type': 'list_item', 'content': "grep 'POST /inport/addInport' /var/log/apache2/access.log"}, {'type': 'list_item', 'content': "grep 'POST /inport/updateInport' /var/log/apache2/access.log"}, {'type': 'list_item', 'content': "grep 'POST /inport/deleteInport' /var/log/apache2/access.log"}, {'type': 'list_item', 'content': "grep 'POST /outport/addOutport' /var/log/apache2/access.log"}, {'type': 'list_item', 'content': "grep 'POST /outport/deleteOutport' /var/log/apache2/access.log"}, {'type': 'paragraph', 'content': 'Additionally, monitoring for unexpected changes in inventory data or stock levels may indicate exploitation.'}] [2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the vulnerable endpoints by implementing proper authorization checks to ensure only authorized users can perform inventory operations.

Since the project has not yet provided a fix or response, consider the following actions:

• Apply network-level access controls such as IP whitelisting or VPN requirements to limit who can reach the affected endpoints.
• Monitor and audit all inventory-related requests for suspicious activity.
• If possible, disable or restrict the addInport, updateInport, deleteInport, addOutport, and deleteOutport endpoints until a patch or update is available.
• Consider replacing the affected component with an alternative product that enforces proper access controls.

Overall, enforcing strict permission checks on these endpoints is critical to prevent unauthorized inventory manipulation.

Useful 0 Not Useful 0