CVE-2026-2078: Yeqifu Warehouse

High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days.

A vulnerability was detected in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This affects the function addPermission/updatePermission/deletePermission of the file dataset\repos\warehouse\src\main\java\com\yeqifu\sys\controller\PermissionController.java of the component Permission Management. Performing a manipulation results in improper authorization. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

• Yeqifu Warehouse: up to and including 2025-10-06

Published 2026-02-07. Last modified 2026-06-17.