---
id: "CVE-2026-124568"
page: "https://infrastack.ai/live/CVE-2026-124568"
kind: "vulnerability"
aliases: ["CVE-2026-124568"]
title: "fuintCatering: refund approval lacks access control, remote attackers can trigger it"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["fuintcatering", "java", "other", "self-hosted"]
not_affected_if: []
published_at: "2026-11-09T05:18:29+00:00"
first_seen_at: "2026-11-09T05:25:21+00:00"
updated_at: "2026-11-09T05:26:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124568", "first_seen_at": "2026-11-09T05:25:21+00:00"}]
exploit_sources: []
---

# fuintCatering: refund approval lacks access control, remote attackers can trigger it

Link for people: https://infrastack.ai/live/CVE-2026-124568 (this .md is for agents)

The fuintCatering refund agreement function RefundServiceImpl.agreeRefund has improper access controls, so a request can approve refunds without the rights it should need. An attacker who can reach the service remotely may be able to approve refunds they should not be allowed to approve.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-09T05:25:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124568

## From the sources

A vulnerability has been found in fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133. Impacted is the function RefundServiceImpl.agreeRefund of the component Refund Agreement. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_