CVE-2026-2076— warehouse 授权问题漏洞
Possible ATT&CK Techniques 1AI
T1068 · Exploitation for Privilege Escalation新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-2076の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
yeqifu warehouse User Management Endpoint UserController.java deleteUser improper authorization
ソース: CVE Program / CVE List V5
脆弱性説明
A weakness has been identified in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. Affected by this vulnerability is the function addUser/updateUser/deleteUser of the file dataset\repos\warehouse\src\main\java\com\yeqifu\sys\controller\UserController.java of the component User Management Endpoint. This manipulation causes improper authorization. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
ソース: CVE Program / CVE List V5
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
ソース: CVE Program / CVE List V5
脆弱性タイプ
授权机制不恰当
ソース: CVE Program / CVE List V5
脆弱性タイトル
warehouse 授权问题漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
warehouse是yeqifu个人开发者的一个基于spring boot的中小型仓库物流管理系统。 warehouse aaf29962ba407d22d991781de28796ee7b4670e4及之前版本存在授权问题漏洞，该漏洞源于用户管理端点存在授权不当。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2026-2076の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-2076のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-2076 其他参考 (1)
Same Patch Batch · yeqifu · 2026-02-07 · 8 CVEs total
| CVE-2026-2075 | 6.3 MEDIUM | yeqifu warehouse Role-Permission Binding RoleController.java saveRolePermission access con |
| CVE-2026-2077 | 6.3 MEDIUM | yeqifu warehouse Role Management RoleController.java deleteRole improper authorization |
| CVE-2026-2078 | 6.3 MEDIUM | yeqifu warehouse Permission Management PermissionController.java deletePermission improper |
| CVE-2026-2079 | 6.3 MEDIUM | yeqifu warehouse Menu Management MenuController.java deleteMenu improper authorization |
| CVE-2026-2105 | 6.3 MEDIUM | yeqifu warehouse Department Management DeptController.java deleteDept improper authorizati |
| CVE-2026-2106 | 6.3 MEDIUM | yeqifu warehouse Notice Management NoticeController.java batchDeleteNotice improper author |
| CVE-2026-2107 | 6.3 MEDIUM | yeqifu warehouse Log Info LoginfoController.java batchDeleteLoginfo improper authorization |
IV. 関連脆弱性
同じ製品: warehouse
- CVE-2026-18903
yeqifu warehouse FileController.java path traversal - CVE-2026-2852
yeqifu warehouse Sales Endpoint SalesController.java deleteS - CVE-2026-2851
yeqifu warehouse Inport Endpoint InportController.java delet - CVE-2026-2850
yeqifu warehouse Customer Endpoint CustomerController.java d - CVE-2026-2849
yeqifu warehouse Cache Sync CacheController.java syncCache a
同じベンダー: yeqifu
- CVE-2026-18903
yeqifu warehouse FileController.java path traversal - CVE-2026-2852
yeqifu warehouse Sales Endpoint SalesController.java deleteS - CVE-2026-2851
yeqifu warehouse Inport Endpoint InportController.java delet - CVE-2026-2850
yeqifu warehouse Customer Endpoint CustomerController.java d - CVE-2026-2849
yeqifu warehouse Cache Sync CacheController.java syncCache a
同じ弱点: CWE-285
- CVE-2026-47663
Pathling: Typed CRUD/search/batch providers can lead to serv - CVE-2026-59118
Microsoft Power Apps Elevation of Privilege Vulnerability - CVE-2026-18367
Sophos Endpoint/Home macOS提权漏洞 - CVE-2026-18998
cosmicstack-labs mercury-agent delegate_task Tool sub-agent. - CVE-2026-18817
Baserow Inactive Non-Staff User serializers.py BaserowImpers
V. CVE-2026-2076へのコメント
まだコメントはありません