CVE-2026-124568: fushengqian fuintCatering Refund Agreement RefundServiceImpl.agreeRefund access control
A vulnerability has been found in fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133. Impacted is the function RefundServiceImpl.agreeRefund of the component Refund Agreement. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require an authenticated account?
Yes. The supplied CVSS vector indicates low privileges are required, so an attacker needs access with low-level permissions. No user interaction is required.
Can this be exploited remotely?
Yes. The issue is remotely reachable according to the advisory, and the CVSS attack vector is network-based.
How can I determine whether a deployment is affected?
The affected code is identified as fuintCatering through commit 6d054f5788ac8645eb491f79242bb8a625efc133. Because the product uses a rolling release, the advisory does not provide affected or fixed version numbers.
Is a vendor-provided fixed release available?
The advisory provides no updated-release details. It also states that the vendor was contacted but did not respond.