CVE-2026-2079: Yeqifu Warehouse Auth Bypass Vulnerability

CVE-2026-2079 Overview

An improper authorization vulnerability has been discovered in the yeqifu warehouse application. This security flaw affects the Menu Management component, specifically targeting the addMenu, updateMenu, and deleteMenu functions within MenuController.java. The vulnerability allows authenticated attackers to bypass authorization controls and perform unauthorized menu management operations through crafted manipulation requests.

Critical Impact

Authenticated attackers can bypass authorization controls to manipulate menu configurations, potentially allowing privilege escalation and unauthorized access to administrative functions within the warehouse management system.

Affected Products

• yeqifu warehouse (rolling release up to commit aaf29962ba407d22d991781de28796ee7b4670e4)
• Yeqifu Warehouse Menu Management Component
• MenuController.java file in dataset\repos\warehouse\src\main\java\com\yeqifu\sys\controller\

Discovery Timeline

• 2026-02-07 - CVE-2026-2079 published to NVD
• 2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-2079

Vulnerability Analysis

This vulnerability is classified as CWE-266 (Incorrect Privilege Assignment), a broken access control flaw that occurs when software does not properly verify whether a user has sufficient privileges to perform an action. In the context of yeqifu warehouse, the Menu Management functions fail to implement adequate authorization checks before allowing menu creation, modification, or deletion operations.

The vulnerability resides in the controller layer of the Java-based web application. When processing requests to the addMenu, updateMenu, or deleteMenu endpoints, the application does not validate whether the authenticated user has the appropriate permissions to perform these administrative actions. This allows lower-privileged users to execute operations that should be restricted to administrators.

Root Cause

The root cause is improper authorization logic in the MenuController.java file. The controller methods responsible for menu management operations lack proper privilege verification before executing sensitive administrative functions. The application appears to rely on authentication alone without implementing role-based access control (RBAC) or permission checks for these critical operations.

Attack Vector

The attack can be launched remotely over the network by any authenticated user. An attacker with low-privilege credentials can send crafted HTTP requests to the menu management endpoints. By directly accessing the addMenu, updateMenu, or deleteMenu functions, the attacker can manipulate menu configurations without proper authorization. This could lead to:

• Creating new menu entries that expose sensitive functionality
• Modifying existing menus to redirect users to malicious endpoints
• Deleting critical menu items to disrupt application functionality
• Escalating privileges by adding administrative menu options

The exploit has been publicly disclosed, making this vulnerability more accessible to potential attackers. The vendor has been notified through an issue report on GitHub but has not yet responded.

Detection Methods for CVE-2026-2079

Indicators of Compromise

• Unexpected or unauthorized changes to application menu configurations
• Log entries showing menu management API calls from non-administrative users
• New menu items appearing without corresponding administrative actions
• Audit trail gaps or inconsistencies in menu modification history

Detection Strategies

• Monitor HTTP requests to /sys/controller/Menu* endpoints for unauthorized access attempts
• Implement logging for all menu management operations with user context
• Review application logs for users performing menu operations outside their assigned roles
• Deploy web application firewalls (WAF) to detect and block suspicious menu manipulation requests

Monitoring Recommendations

• Enable detailed access logging for the MenuController.java endpoints
• Set up alerts for menu modification events from non-administrative accounts
• Regularly audit menu configurations for unauthorized changes
• Implement real-time monitoring of privilege escalation patterns

How to Mitigate CVE-2026-2079

Immediate Actions Required

• Restrict access to menu management endpoints to trusted administrative IP addresses
• Implement additional authentication layers for administrative functions
• Review and audit all existing menu configurations for unauthorized modifications
• Consider temporarily disabling public access to the menu management functionality until patched

Patch Information

As of the last update on 2026-02-10, no official patch has been released. The yeqifu warehouse project operates on a rolling release basis and the vendor has not yet responded to the vulnerability disclosure. Monitor the GitHub repository and the related issue for updates on fixes. Organizations using this software should implement the workarounds below until an official patch becomes available.

Workarounds

• Implement application-level authorization checks using Spring Security or similar frameworks
• Add role-based access control annotations (@PreAuthorize, @Secured) to the affected controller methods
• Deploy a reverse proxy or API gateway to enforce authorization before requests reach the application
• Limit menu management access to trusted internal networks only

# Example: Restrict access to menu management endpoints via nginx
location ~ ^/sys/controller/Menu {
    allow 192.168.1.0/24;  # Internal admin network only
    deny all;
    proxy_pass http://backend;
}