CVE-2026-2849

Katalog CVE

CVSS 6.3 · Medium EPSS 0,41%

Kerentanan Incorrect Privilege Assignment pada yeqifu warehouse. Skor CVSS 3.1 6.3 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability has been found in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. Affected by this issue is the function deleteCache/removeAllCache/syncCache of the file dataset\repos\warehouse\src\main\java\com\yeqifu\sys\controller\CacheController.java of the component Cache Sync Handler. Such manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

Rincian

Terbit di NVD

20 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment
CWE-284: Improper Access Control

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vuldb.com/?id.347085 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.754428 advisory pihak ketiga · vdb entry
• https://github.com/yeqifu/warehouse/issues/60 exploit · issue tracking
• https://github.com/yeqifu/warehouse/issues/60#issue-3846666902 exploit · issue tracking
• https://github.com/yeqifu/warehouse/ product
• https://vuldb.com/?ctiid.347085 permissions required · vdb entry