CVE-2026-124567 · Other
NO FIX YET
A flaw in the receipt function of fuint's ClientOrderController.java lets a manipulated request cause an order state problem. The attack can be run remotely, and the sources give no further detail on the impact.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
fuint is a self-hosted order and marketing application; sources say it is affected up to commit 36cc31b08d77facc94e8959afa02224891b4fe5f and that the vendor did not respond to early disclosure. Teams running fuint's client order API should look for it in their deployments. Sources do not state the exact configuration or role needed to reach the flawed function.
Not affected if unknown
Who cares fuint, java, self-hosted
Unknown from the sources.
No fix yet, per the sources.
A flaw has been found in fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f. This issue affects the function receipt of the file ClientOrderController.java. Executing a manipulation can lead to state issue. The attack may be performed from remote. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.