CVE-2026-2106

Katalog CVE

CVSS 8.8 · High EPSS 0,37%

Kerentanan Incorrect Privilege Assignment pada yeqifu warehouse. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability has been found in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. The impacted element is the function addNotice/updateNotice/deleteNotice/batchDeleteNotice of the file dataset\repos\warehouse\src\main\java\com\yeqifu\sys\controller\NoticeController.java of the component Notice Management. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Rincian

Terbit di NVD

7 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment
CWE-285: Improper Authorization

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 28,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/yeqifu/warehouse/issues/58 exploit · issue tracking · advisory vendor
• https://github.com/yeqifu/warehouse/issues/58#issue-3846664260 exploit · issue tracking · advisory vendor
• https://vuldb.com/?id.344682 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.745516 advisory pihak ketiga · vdb entry
• https://github.com/yeqifu/warehouse/ product
• https://vuldb.com/?ctiid.344682 permissions required · vdb entry