Yeqifu Warehouse Has a Security Risk in Data Handling

Summary

A vulnerability in Yeqifu Warehouse's data handling system could allow unauthorized access to sensitive information. This means someone with the right tools could potentially view or alter data they shouldn't be able to. We recommend checking with the vendor for an update, as the exact version affected is unclear.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
yeqifu	warehouse	<= 2025-10-06	–

Original title

A vulnerability was determined in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This vulnerability affects the function addInport/updateInport/deleteInport of the file dataset\re...

Original description

A vulnerability was determined in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This vulnerability affects the function addInport/updateInport/deleteInport of the file dataset\repos\warehouse\src\main\java\com\yeqifu\bus\controller\InportController.java of the component Inport Endpoint. Executing a manipulation can lead to improper access controls. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

nvd CVSS2.0 6.5

nvd CVSS3.1 5.3

nvd CVSS4.0 5.3

Vulnerability type

CWE-266 Incorrect Privilege Assignment

CWE-284 Improper Access Control

https://github.com/yeqifu/warehouse/ Product
https://github.com/yeqifu/warehouse/issues/62 Exploit Issue Tracking
https://github.com/yeqifu/warehouse/issues/62#issue-3846670634 Exploit Issue Tracking
https://vuldb.com/?ctiid.347087 Permissions Required VDB Entry
https://vuldb.com/?id.347087 Third Party Advisory VDB Entry
https://vuldb.com/?submit.754430 Third Party Advisory VDB Entry