CVE-2026-124567: fushengqian fuint ClientOrderController.java receipt state issue

Q: What level of access does an attacker need?

The vulnerability is remotely reachable and has low attack complexity, but the attacker must have low-level privileges. No user interaction is required.

Q: Are fixed releases or affected version ranges available?

No version range or fixed release is disclosed because the product uses a rolling-release continuous-delivery model. The issue is known to affect code up to commit 36cc31b08d77facc94e8959afa02224891b4fe5f.

Q: What is the likely security impact?

The reported impact is a state-management issue in the receipt function of ClientOrderController.java. The CVSS vector indicates integrity impact only, with no reported confidentiality or availability impact.

Q: Did the vendor provide remediation guidance?

No. The vendor was contacted early in the disclosure process but did not respond, and no vendor remediation or mitigation guidance is provided.

Published Nov 9, 2026

Updated

A flaw has been found in fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f. This issue affects the function receipt of the file ClientOrderController.java. Executing a manipulation can lead to state issue. The attack may be performed from remote. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

1 affected component

fushengqian fuint<=36cc31b08d77facc94e8959afa02224891b4fe5f

Event History

Nov 9, 2026

CVE Published

via MITRE·04:45 AM

Data Sourced

via MITRE·04:45 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:18 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need?

The vulnerability is remotely reachable and has low attack complexity, but the attacker must have low-level privileges. No user interaction is required.

Are fixed releases or affected version ranges available?

No version range or fixed release is disclosed because the product uses a rolling-release continuous-delivery model. The issue is known to affect code up to commit 36cc31b08d77facc94e8959afa02224891b4fe5f.

What is the likely security impact?

The reported impact is a state-management issue in the receipt function of ClientOrderController.java. The CVSS vector indicates integrity impact only, with no reported confidentiality or availability impact.

Did the vendor provide remediation guidance?

No. The vendor was contacted early in the disclosure process but did not respond, and no vendor remediation or mitigation guidance is provided.

CVE-2026-124567: fushengqian fuint ClientOrderController.java receipt state issue

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need?

Are fixed releases or affected version ranges available?

What is the likely security impact?

Did the vendor provide remediation guidance?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need?

Are fixed releases or affected version ranges available?

What is the likely security impact?

Did the vendor provide remediation guidance?