{"id":"CVE-2026-124568","kind":"vulnerability","aliases":["CVE-2026-124568"],"related":[],"title":"fuintCatering: refund approval lacks access control, remote attackers can trigger it","description":"A vulnerability has been found in fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133. Impacted is the function RefundServiceImpl.agreeRefund of the component Refund Agreement. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The fuintCatering refund agreement function RefundServiceImpl.agreeRefund has improper access controls, so a request can approve refunds without the rights it should need. An attacker who can reach the service remotely may be able to approve refunds they should not be allowed to approve.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fuintcatering","java","other","self-hosted"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-09T05:18:29+00:00","first_seen_at":"2026-11-09T05:25:21+00:00","triaged_at":"2026-11-09T05:26:51+00:00","updated_at":"2026-11-09T05:26:51+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-09T05:26:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"fuintCatering: refund approval lacks access control, remote attackers can trigger it","impact":"medium","summary":"The fuintCatering refund agreement function RefundServiceImpl.agreeRefund has improper access controls, so a request can approve refunds without the rights it should need. An attacker who can reach the service remotely may be able to approve refunds they should not be allowed to approve.","audience":"businesses","category":"other","nicknames":[],"who_cares":["fuintcatering","self-hosted","java"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote user approves refunds without authorization","analyst_note":"Confirm the affected code path in the fuintCatering repository and whether agreeRefund requires authentication or a role check; no fixed version exists in the sources.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running fuintCatering, a catering and ordering system, in a deployment reachable over the network. The sources do not say which roles or configurations are needed, and the product uses rolling releases with no version details, so exposure cannot be narrowed by version. Teams that do not run fuintCatering can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000703,"input_tokens":4638,"output_tokens":479,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124568':13A,16A '-2026':12A,15A '6d054f5788ac8645eb491f79242bb8a625efc133':76C 'abl':55B 'access':5A,31B,92C 'affect':118C 'agreement':26B,86C 'allow':63B 'approv':3A,37B,57B,65B 'attack':8A,46B,100C 'avail':123C 'compon':84C 'contact':127C 'contini':111C 'control':6A,32B,93C 'cve':11A,14A 'deliveri':112C 'detail':116C 'disclosur':131C 'earli':128C 'found':70C 'fuintcat':1A,17B,24B,73C 'function':27B,80C 'fushengqian':72C 'host':22B 'impact':77C 'improp':30B,91C 'initi':98C 'java':18B 'lack':4A 'lead':89C 'manipul':88C 'may':53B 'need':44B 'possibl':96C 'product':103C 'provid':110C 'reach':49B 'refund':2A,25B,38B,58B,85C 'refundserviceimpl.agreerefund':28B,81C 'releas':108C,121C 'remot':7A,52B,101C 'request':35B 'respond':135C 'right':41B 'roll':107C 'self':21B 'self-host':20B 'servic':51B 'therefor':113C 'trigger':10A 'updat':120C 'use':105C 'vendor':125C 'version':115C 'vulner':67C 'way':138C 'without':39B","nicknames":[],"mitigations":[],"who_affected":"Teams running fuintCatering, a catering and ordering system, in a deployment reachable over the network. The sources do not say which roles or configurations are needed, and the product uses rolling releases with no version details, so exposure cannot be narrowed by version. Teams that do not run fuintCatering can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fuintcatering","java","medium","other","selfhosted"],"campaign_type":null,"search_a":"'-124568':13A,16A '-2026':12A,15A 'access':5A 'approv':3A 'attack':8A 'control':6A 'cve':11A,14A 'fuintcat':1A 'lack':4A 'refund':2A 'remot':7A 'trigger':10A","search_b":"'abl':55B 'access':31B 'agreement':26B 'allow':63B 'approv':37B,57B,65B 'attack':46B 'control':32B 'fuintcat':17B,24B 'function':27B 'host':22B 'improp':30B 'java':18B 'may':53B 'need':44B 'reach':49B 'refund':25B,38B,58B 'refundserviceimpl.agreerefund':28B 'remot':52B 'request':35B 'right':41B 'self':21B 'self-host':20B 'servic':51B 'without':39B","search_c":"'6d054f5788ac8645eb491f79242bb8a625efc133':76C 'access':92C 'affect':118C 'agreement':86C 'attack':100C 'avail':123C 'compon':84C 'contact':127C 'contini':111C 'control':93C 'deliveri':112C 'detail':116C 'disclosur':131C 'earli':128C 'found':70C 'fuintcat':73C 'function':80C 'fushengqian':72C 'impact':77C 'improp':91C 'initi':98C 'lead':89C 'manipul':88C 'possibl':96C 'product':103C 'provid':110C 'refund':85C 'refundserviceimpl.agreerefund':81C 'releas':108C,121C 'remot':101C 'respond':135C 'roll':107C 'therefor':113C 'updat':120C 'use':105C 'vendor':125C 'version':115C 'vulner':67C 'way':138C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T05:18:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124568","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124568","severity":null,"published_at":"2026-11-09T05:18:29+00:00","modified_at":"2026-11-09T05:18:29+00:00","first_seen_at":"2026-11-09T05:25:21+00:00","fetched_at":"2026-11-09T05:25:21+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}