State Manipulation Vulnerability in fushengqian fuint by Vendor
CVE-2026-124567

5.3MEDIUM

Key Information:

Vendor

Fushengqian

Status
Fuint
Vendor
CVE Published:
9 November 2026

What is CVE-2026-124567?

A vulnerability exists in the fushengqian fuint product, specifically in the receipt function of the ClientOrderController.java file. This flaw allows an attacker to manipulate the state remotely, potentially leading to unauthorized actions or access. The product employs a rolling release system for continuous updates, hence details about affected versions are not publicly available. Despite being informed about this issue, the vendor has not provided a response or issued any updates.

Affected Version(s)

fuint 36cc31b08d77facc94e8959afa02224891b4fe5f

References

https://vuldb.com/vuln/432899
vdb-entrytechnical-description
https://vuldb.com/vuln/432899/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-124567
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Y1Daa (VulDB User)
VulDB CNA Team
.