{"id":"CVE-2026-124565","kind":"vulnerability","aliases":["CVE-2026-124565"],"related":[],"title":"fuint: order verification flaw lets remote callers bypass access controls","description":"A security vulnerability has been detected in fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f. This affects the function confirm of the file MerchantOrderController.java of the component Order Verification. Such manipulation leads to improper access controls. The attack can be executed remotely. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"A flaw in the confirm function of MerchantOrderController.java in the fuint project allows improper access control on order verification. A remote attacker can exploit it over the network without a named authentication requirement in the sources.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fuint","merchant-orders","other","self-hosted"],"not_affected_if":["not-using-fuint"],"how_to_check":"- Check whether your deployment runs fuint and whether it includes MerchantOrderController.java with the confirm function\n- Compare your deployed commit against 36cc31b08d77facc94e8959afa02224891b4fe5f, the last version the sources say is affected","fix":null,"status":"open","published_at":"2026-11-09T05:18:27+00:00","first_seen_at":"2026-11-09T05:25:20+00:00","triaged_at":"2026-11-09T05:26:55+00:00","updated_at":"2026-11-09T05:26:55+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-09T05:26:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"fuint: order verification flaw lets remote callers bypass access controls","impact":"medium","summary":"A flaw in the confirm function of MerchantOrderController.java in the fuint project allows improper access control on order verification. A remote attacker can exploit it over the network without a named authentication requirement in the sources.","audience":"businesses","category":"other","nicknames":[],"who_cares":["fuint","self-hosted","merchant-orders"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Unauthorized order verification actions, possibly on merchant orders","analyst_note":"Confirm the exact access control gap in MerchantOrderController.java confirm() and whether authentication is required; check for any vendor response or fix on the NVD entry.","how_to_check":"- Check whether your deployment runs fuint and whether it includes MerchantOrderController.java with the confirm function\n- Compare your deployed commit against 36cc31b08d77facc94e8959afa02224891b4fe5f, the last version the sources say is affected\n- unknown for any further check, as the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-using-fuint"],"who_is_affected":"Teams that run the fuint merchant or order verification system, from the affected commit onward. The sources describe the product as rolling release with no version data and state the vendor did not respond, so no fixed version is known. Deployments that do not use fuint are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000742,"input_tokens":4629,"output_tokens":559,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124565':13A,16A '-2026':12A,15A '36cc31b08d77facc94e8959afa02224891b4fe5f':72C 'access':9A,39B,92C 'affect':74C,114C 'allow':37B 'attack':46B,95C 'authent':56B 'bypass':8A 'caller':7A 'compon':84C 'confirm':29B,77C 'contact':123C 'control':10A,40B,93C 'cve':11A,14A 'deliveri':108C 'detect':66C 'disclosur':127C 'earli':124C 'execut':98C 'exploit':48B 'file':80C 'flaw':4A,26B 'fuint':1A,17B,35B,69C 'function':30B,76C 'fushengqian':68C 'host':24B 'implement':102C 'improp':38B,91C 'inform':112C 'lead':89C 'let':5A 'manipul':88C 'mean':110C 'merchant':19B 'merchant-ord':18B 'merchantordercontroller.java':32B,81C 'name':55B 'network':52B 'ongo':107C 'order':2A,20B,42B,85C 'product':101C 'project':36B 'releas':105C,117C 'remot':6A,45B,99C 'requir':57B 'respond':131C 'roll':104C 'secur':62C 'self':23B 'self-host':22B 'sourc':60B 'unavail':119C 'updat':116C 'vendor':121C 'verif':3A,43B,86C 'version':111C 'vulner':63C 'way':134C 'without':53B","nicknames":[],"mitigations":[],"who_affected":"Teams that run the fuint merchant or order verification system, from the affected commit onward. The sources describe the product as rolling release with no version data and state the vendor did not respond, so no fixed version is known. Deployments that do not use fuint are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fuint","medium","merchantorders","other","selfhosted"],"campaign_type":null,"search_a":"'-124565':13A,16A '-2026':12A,15A 'access':9A 'bypass':8A 'caller':7A 'control':10A 'cve':11A,14A 'flaw':4A 'fuint':1A 'let':5A 'order':2A 'remot':6A 'verif':3A","search_b":"'access':39B 'allow':37B 'attack':46B 'authent':56B 'confirm':29B 'control':40B 'exploit':48B 'flaw':26B 'fuint':17B,35B 'function':30B 'host':24B 'improp':38B 'merchant':19B 'merchant-ord':18B 'merchantordercontroller.java':32B 'name':55B 'network':52B 'order':20B,42B 'project':36B 'remot':45B 'requir':57B 'self':23B 'self-host':22B 'sourc':60B 'verif':43B 'without':53B","search_c":"'36cc31b08d77facc94e8959afa02224891b4fe5f':72C 'access':92C 'affect':74C,114C 'attack':95C 'compon':84C 'confirm':77C 'contact':123C 'control':93C 'deliveri':108C 'detect':66C 'disclosur':127C 'earli':124C 'execut':98C 'file':80C 'fuint':69C 'function':76C 'fushengqian':68C 'implement':102C 'improp':91C 'inform':112C 'lead':89C 'manipul':88C 'mean':110C 'merchantordercontroller.java':81C 'ongo':107C 'order':85C 'product':101C 'releas':105C,117C 'remot':99C 'respond':131C 'roll':104C 'secur':62C 'unavail':119C 'updat':116C 'vendor':121C 'verif':86C 'version':111C 'vulner':63C 'way':134C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T05:18:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124565","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124565","severity":null,"published_at":"2026-11-09T05:18:27+00:00","modified_at":"2026-11-09T05:18:28+00:00","first_seen_at":"2026-11-09T05:25:20+00:00","fetched_at":"2026-11-09T05:25:20+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}