PT-2026-6914 · Unknown · Yeqifu Warehouse

Alices614 · Publicado 2026-02-07 · Atualizado 2026-02-07 · CVE-2026-2106

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions yeqifu warehouse versions prior to aaf29962ba407d22d991781de28796ee7b4670e4

Description A flaw exists within the Notice Management component of yeqifu warehouse, specifically in the addNotice(), updateNotice(), deleteNotice(), and batchDeleteNotice() functions located in the file datasetreposwarehousesrcmainjavacomyeqifusyscontrollerNoticeController.java. This issue results in improper authorization and can be exploited remotely. The exploit details have been publicly disclosed. The product utilizes continuous delivery with rolling releases, and the project maintainers have been notified but have not yet responded.

Recommendations Apply updates to yeqifu warehouse beyond aaf29962ba407d22d991781de28796ee7b4670e4. As a temporary workaround, restrict access to the addNotice(), updateNotice(), deleteNotice(), and batchDeleteNotice() functions.

Exploit

Correção

Improper Authorization

Incorrect Privilege Assignment

Enumeração de Fraquezas

CWE-285

CWE-266

Identificadores relacionados

CVE-2026-2106

Produtos afetados

Yeqifu Warehouse

Referências · 11

• 🔥 https://github.com/yeqifu/warehouse/issues/58#issue-3846664260 · Exploit
• https://github.com/yeqifu/warehouse/issues/58 · Aviso do Fabricante
• https://github.com/yeqifu/warehouse · Nota
• https://vuldb.com/?id.344682 · Nota
• https://t.me/CVEtracker/44045 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-2106 · Aviso do Fabricante
• https://vuldb.com/?ctiid.344682 · Nota
• https://t.me/cveNotify/151258 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2020193753776935247 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-2106 · Nota de Segurança
• https://vuldb.com/?submit.745516 · Nota