Improper Access Control in fushengqian fuintCatering Refund Agreement
CVE-2026-124568

5.3MEDIUM

Key Information:

Vendor

Fushengqian

Status
Fuintcatering
Vendor
CVE Published:
9 November 2026

What is CVE-2026-124568?

A vulnerability exists in the Refund Agreement component of fushengqian fuintCatering up to version 6d054f5788ac8645eb491f79242bb8a625efc133. The issue arises in the RefundServiceImpl.agreeRefund function, where inadequate access controls can be exploited to manipulate refund processes. This flaw allows attackers to initiate remote attacks, potentially compromising the integrity of financial transactions. Notably, due to the rolling release mechanism employed by the product, specific version details regarding affected and updated releases are not publicly available. Despite early disclosures to the vendor, there has been no communication or action taken regarding the remediation of this vulnerability.

Affected Version(s)

fuintCatering 6d054f5788ac8645eb491f79242bb8a625efc133

References

https://vuldb.com/vuln/432900
vdb-entrytechnical-description
https://vuldb.com/vuln/432900/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-124568
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Y1Daa (VulDB User)
VulDB CNA Team
.