FUINTCATERING · CVE-2026-124569 · Other
NO FIX YET
A flaw in the updateCommissionCash function of fuintCatering's CommissionCashServiceImpl.java lets a caller manipulate the Status argument without proper access checks. A remote attacker may be able to change commission cash status records they should not control.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run fuintCatering from source, including rolling deployments of the project, are potentially exposed because the vulnerable version range covers all releases up to a single commit. The sources do not describe the specific configuration or authentication requirements, and the vendor has not responded to the disclosure. Deployments that do not expose the commission cash endpoints to untrusted callers are likely less exposed.
Who cares fuintcatering, self-hosted
Unknown from the sources.
No fix yet, per the sources.
A vulnerability was found in fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133. The affected element is the function updateCommissionCash of the file CommissionCashServiceImpl.java. The manipulation of the argument Status results in improper access controls. It is possible to launch the attack remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.