CVE-2026-2105: Yeqifu Warehouse Auth Bypass Vulnerability

CVE-2026-2105 Overview

A significant improper authorization vulnerability has been discovered in yeqifu warehouse, an open-source warehouse management system. The vulnerability affects the Department Management component, specifically the addDept, updateDept, and deleteDept functions within the DeptController.java file. This flaw allows attackers to bypass authorization controls and perform unauthorized operations on department records.

Critical Impact

Remote attackers with low-level privileges can exploit improper authorization in Department Management functions to add, update, or delete department records without proper access control verification.

Affected Products

• yeqifu warehouse (up to commit aaf29962ba407d22d991781de28796ee7b4670e4)
• Yeqifu Warehouse (rolling release model - all versions potentially affected)

Discovery Timeline

• 2026-02-07 - CVE-2026-2105 published to NVD
• 2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-2105

Vulnerability Analysis

This vulnerability is classified as CWE-266 (Incorrect Privilege Assignment), which occurs when software fails to properly restrict access to privileged functionality. The affected file is located at dataset\repos\warehouse\src\main\java\com\yeqifu\sys\controller\DeptController.java, which handles department management operations in the warehouse system.

The vulnerability allows authenticated users with minimal privileges to perform administrative operations on department records. The three affected functions—addDept, updateDept, and deleteDept—lack proper authorization checks to verify whether the requesting user has sufficient permissions to perform these operations. This enables horizontal and vertical privilege escalation within the application.

Since yeqifu warehouse follows a rolling release model, specific version information is not available. The project maintainers were notified through GitHub Issue #57 but have not yet responded.

Root Cause

The root cause of this vulnerability lies in insufficient authorization validation within the Department Controller class. The addDept, updateDept, and deleteDept methods do not implement proper access control checks to verify that the authenticated user has the necessary privileges to perform department management operations. This allows users with basic authentication to execute privileged administrative actions.

Attack Vector

The attack can be launched remotely over the network by any authenticated user. An attacker would need to:

1. Obtain valid credentials (even low-privilege accounts are sufficient)
2. Send crafted HTTP requests to the Department Management endpoints
3. Manipulate department records (create, modify, or delete) without proper authorization

The vulnerability mechanism involves direct calls to the department management endpoints. Authenticated requests to the addDept, updateDept, or deleteDept controller functions bypass authorization checks, allowing unauthorized data manipulation. Technical details and proof-of-concept information are available through the VulDB entry and the GitHub issue report.

Detection Methods for CVE-2026-2105

Indicators of Compromise

• Unexpected department record modifications or deletions in application logs
• Unusual API calls to /dept/addDept, /dept/updateDept, or /dept/deleteDept endpoints from low-privileged user accounts
• Audit logs showing department management operations by users who should not have such access
• Multiple rapid department manipulation requests from a single user session

Detection Strategies

• Implement application-level logging for all department management operations, capturing user context and privilege levels
• Configure web application firewall (WAF) rules to alert on suspicious patterns of requests to department management endpoints
• Enable audit logging on the database to track INSERT, UPDATE, and DELETE operations on department tables
• Deploy runtime application self-protection (RASP) solutions to detect authorization bypass attempts

Monitoring Recommendations

• Monitor authentication logs for accounts performing department management actions outside their normal scope
• Set up alerts for bulk department modifications from single user sessions
• Review access control lists and role assignments for the warehouse application regularly
• Correlate application logs with database audit logs to identify discrepancies in authorized operations

How to Mitigate CVE-2026-2105

Immediate Actions Required

• Review and restrict access to department management endpoints to only administrator-level accounts
• Implement additional authorization checks at the application layer for all privileged operations
• Audit existing department records for unauthorized modifications
• Consider temporarily disabling department management functionality until a patch is available

Patch Information

No official patch has been released by the vendor at this time. The project maintainers were notified through GitHub Issue #57 but have not responded. Organizations using yeqifu warehouse should monitor the project repository for updates and consider implementing manual code fixes to add proper authorization checks to the affected controller methods.

Workarounds

• Implement a reverse proxy or API gateway to enforce additional authorization rules on department management endpoints
• Add role-based access control (RBAC) checks in a custom security filter before requests reach the DeptController
• Restrict network access to the warehouse application to trusted IP ranges only
• Deploy the application behind a VPN to limit the attack surface for remote exploitation

# Example: Restrict access to department management endpoints using nginx
# Add to your nginx server configuration

location ~ ^/dept/(addDept|updateDept|deleteDept) {
    # Restrict to administrator IP ranges only
    allow 10.0.0.0/8;
    allow 192.168.1.0/24;
    deny all;
    
    # Forward authorized requests to the application
    proxy_pass http://warehouse-app:8080;
}