Medium severity6.3NVD Advisory· Published Jan 4, 2026· Updated Apr 29, 2026

CVE-2026-0574

Description

A weakness has been identified in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This affects the function saveUserRole of the file warehouse\src\main\java\com\yeqifu\sys\controller\UserController.java of the component Request Handler. This manipulation causes improper authorization. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Yeqifu/Warehouse2 versions
cpe:2.3:a:yeqifu:warehouse:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:yeqifu:warehouse:*:*:*:*:*:*:*:*range: <=2025-10-06
- (no CPE)range: <= aaf29962ba407d22d991781de28796ee7b4670e4

Patches

Vulnerability mechanics

References

github.com/5i1encee/Vul/blob/main/Vertical_privilege_escalation_Vulnerability_in_Project_yeqifu_warehouse.mdnvdExploitThird Party Advisory
github.com/5i1encee/Vul/blob/main/Vertical_privilege_escalation_Vulnerability_in_Project_yeqifu_warehouse.mdnvdExploit
vuldb.comnvdThird Party AdvisoryVDB Entry
vuldb.comnvdThird Party AdvisoryVDB Entry
vuldb.comnvdPermissions RequiredVDB Entry

News mentions

No linked articles in our index yet.

cvss	0.410
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000