CVE-2026-2075: Yeqifu Warehouse Auth Bypass Vulnerability

CVE-2026-2075 Overview

A security flaw has been discovered in Yeqifu Warehouse affecting the saveRolePermission function within the Role-Permission Binding Handler component. This improper access control vulnerability allows attackers to manipulate role-permission bindings through network-accessible endpoints. The vulnerability exists in the file dataset\repos\warehouse\src\main\java\com\yeqifu\sys\controller\RoleController.java and can be exploited remotely by authenticated users with low privileges.

The exploit has been publicly released, increasing the risk of active exploitation. This project uses rolling releases for continuous delivery, which means specific version details for affected and updated releases are not available. The vendor was notified through a GitHub issue but has not yet responded.

Critical Impact

Authenticated attackers can manipulate role-permission bindings remotely, potentially escalating privileges or modifying access controls within the warehouse management system.

Affected Products

• Yeqifu Warehouse (all versions up to commit aaf29962ba407d22d991781de28796ee7b4670e4)

Discovery Timeline

• 2026-02-07 - CVE CVE-2026-2075 published to NVD
• 2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-2075

Vulnerability Analysis

This vulnerability is classified as CWE-266 (Incorrect Privilege Assignment), which occurs when a product does not properly assign or manage privileges for a user, creating an unintended sphere of control. In the context of Yeqifu Warehouse, the saveRolePermission function in RoleController.java fails to implement adequate access control checks before allowing modifications to role-permission mappings.

The vulnerability allows authenticated users to bypass intended authorization restrictions and modify role-permission relationships. This could enable horizontal privilege escalation, where a user gains access to resources belonging to other users at the same privilege level, or potentially vertical privilege escalation if administrative permissions can be assigned.

Root Cause

The root cause lies in the improper implementation of access controls within the saveRolePermission function. The handler does not adequately verify whether the requesting user has sufficient privileges to modify role-permission bindings before processing the request. This allows any authenticated user to potentially manipulate the system's access control configurations.

Attack Vector

The attack can be launched remotely over the network by authenticated users. An attacker with low-level credentials can send malicious requests to the Role-Permission Binding Handler endpoint to manipulate permission assignments. Since the exploit has been publicly released, threat actors can leverage existing proof-of-concept materials to craft attacks against vulnerable installations.

The attack flow involves:

1. Authenticating to the Yeqifu Warehouse application with any valid user credentials
2. Sending crafted requests to the saveRolePermission endpoint
3. Manipulating role-permission bindings to gain unauthorized access or escalate privileges

Technical details regarding the specific exploitation methodology can be found in the GitHub Issue #52 security report.

Detection Methods for CVE-2026-2075

Indicators of Compromise

• Unexpected modifications to role-permission mappings in the warehouse database
• Unusual API calls to the RoleController endpoints from unauthorized or low-privilege users
• Audit log entries showing permission changes without corresponding administrative actions
• Users accessing resources or functions beyond their assigned privilege level

Detection Strategies

• Monitor authentication and authorization logs for anomalous access patterns to role management endpoints
• Implement behavioral analysis to detect privilege escalation attempts targeting the saveRolePermission function
• Review database audit logs for unauthorized modifications to role-permission relationship tables
• Deploy application-layer intrusion detection to identify malicious requests to the Role-Permission Binding Handler

Monitoring Recommendations

• Enable comprehensive logging for all role and permission modification operations within Yeqifu Warehouse
• Set up alerts for any changes to administrative role-permission bindings
• Implement real-time monitoring of the RoleController.java endpoints for suspicious request patterns
• Regularly audit user privilege assignments to detect unauthorized escalations

How to Mitigate CVE-2026-2075

Immediate Actions Required

• Restrict network access to the Yeqifu Warehouse application to trusted networks and users only
• Implement additional authentication requirements for role-permission modification operations
• Review and audit all current role-permission assignments for unauthorized changes
• Consider placing the application behind a web application firewall (WAF) with rules to detect privilege escalation attempts

Patch Information

No official patch is currently available from the vendor. The project maintainers were notified through GitHub Issue #52 but have not yet responded. As Yeqifu Warehouse uses rolling releases, users should monitor the GitHub repository for updates addressing this vulnerability.

Organizations using this software should:

1. Subscribe to repository notifications for security-related commits
2. Check for commits addressing access control in RoleController.java
3. Consider forking and implementing access control fixes independently if vendor remediation is delayed

Workarounds

• Implement network-level access controls to restrict which users can reach the warehouse application
• Add authentication proxy or gateway controls to enforce stricter access policies on sensitive endpoints
• Manually add authorization checks at the application server level to validate permissions before processing role-permission requests
• Disable or restrict access to the saveRolePermission endpoint until an official fix is available

# Example: Restrict access to the application using iptables (adjust as needed)
# Allow only trusted IP ranges to access the warehouse application port
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP