CVE-2026-124568 · Other
NO FIX YET
The fuintCatering refund agreement function RefundServiceImpl.agreeRefund has improper access controls, so a request can approve refunds without the rights it should need. An attacker who can reach the service remotely may be able to approve refunds they should not be allowed to approve.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running fuintCatering, a catering and ordering system, in a deployment reachable over the network. The sources do not say which roles or configurations are needed, and the product uses rolling releases with no version details, so exposure cannot be narrowed by version. Teams that do not run fuintCatering can skip it.
Who cares fuintcatering, java, self-hosted
Unknown from the sources.
No fix yet, per the sources.
A vulnerability has been found in fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133. Impacted is the function RefundServiceImpl.agreeRefund of the component Refund Agreement. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.