CVE-2026-0574 is an improper authorization vulnerability in the yeqifu warehouse application, specifically within the saveUserRole function of the UserController.java component, affecting versions up to commit aaf29962ba407d22d991781de28796ee7b4670e4. This flaw allows a remote attacker to manipulate user roles, leading to high confidentiality, integrity, and availability impacts, as reflected by its CVSS score of 8.8 (High). While public exploit code is available, there is currently no evidence of active exploitation, and it has received minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2025-10-06CPE matchmatch criteria | cpe:2.3:a:yeqifu:warehouse:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.