---
id: "CVE-2026-124565"
page: "https://infrastack.ai/live/CVE-2026-124565"
kind: "vulnerability"
aliases: ["CVE-2026-124565"]
title: "fuint: order verification flaw lets remote callers bypass access controls"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["fuint", "merchant-orders", "other", "self-hosted"]
not_affected_if: ["not-using-fuint"]
published_at: "2026-11-09T05:18:27+00:00"
first_seen_at: "2026-11-09T05:25:20+00:00"
updated_at: "2026-11-09T05:26:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124565", "first_seen_at": "2026-11-09T05:25:20+00:00"}]
exploit_sources: []
---

# fuint: order verification flaw lets remote callers bypass access controls

Link for people: https://infrastack.ai/live/CVE-2026-124565 (this .md is for agents)

A flaw in the confirm function of MerchantOrderController.java in the fuint project allows improper access control on order verification. A remote attacker can exploit it over the network without a named authentication requirement in the sources.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether your deployment runs fuint and whether it includes MerchantOrderController.java with the confirm function
- Compare your deployed commit against 36cc31b08d77facc94e8959afa02224891b4fe5f, the last version the sources say is affected

## Timeline

- 2026-11-09T05:25:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124565

## From the sources

A security vulnerability has been detected in fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f. This affects the function confirm of the file MerchantOrderController.java of the component Order Verification. Such manipulation leads to improper access controls. The attack can be executed remotely. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_