{"id":"CVE-2026-124569","kind":"vulnerability","aliases":["CVE-2026-124569"],"related":[],"title":"fuintCatering: improper access control in commission cash status update","description":"A vulnerability was found in fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133. The affected element is the function updateCommissionCash of the file CommissionCashServiceImpl.java. The manipulation of the argument Status results in improper access controls. It is possible to launch the attack remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"A flaw in the updateCommissionCash function of fuintCatering's CommissionCashServiceImpl.java lets a caller manipulate the Status argument without proper access checks. A remote attacker may be able to change commission cash status records they should not control.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"fuintCatering","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["fuintcatering","other","self-hosted"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-09T06:17:57+00:00","first_seen_at":"2026-11-09T06:25:02+00:00","triaged_at":"2026-11-09T06:26:55+00:00","updated_at":"2026-11-09T06:26:55+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-09T06:26:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"fuintCatering: improper access control in commission cash status update","impact":"medium","summary":"A flaw in the updateCommissionCash function of fuintCatering's CommissionCashServiceImpl.java lets a caller manipulate the Status argument without proper access checks. A remote attacker may be able to change commission cash status records they should not control.","audience":"businesses","category":"other","nicknames":[],"who_cares":["fuintcatering","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote caller alters commission cash status records without authorization","analyst_note":"Confirm the affected endpoint, required authentication, and whether any upstream commit fixes updateCommissionCash; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-124569.","how_to_check":"- unknown","plain_action":"","product_name":"fuintCatering","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams that run fuintCatering from source, including rolling deployments of the project, are potentially exposed because the vulnerable version range covers all releases up to a single commit. The sources do not describe the specific configuration or authentication requirements, and the vendor has not responded to the disclosure. Deployments that do not expose the commission cash endpoints to untrusted callers are likely less exposed.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000736,"input_tokens":4642,"output_tokens":543,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124569':12A,15A '-2026':11A,14A '6d054f5788ac8645eb491f79242bb8a625efc133':68C 'abl':48B 'access':3A,41B,89C 'affect':70C,115C 'approach':103C 'argument':38B,84C 'attack':45B,97C 'avail':121C 'caller':34B 'cash':7A,52B 'chang':50B 'check':42B 'commiss':6A,51B 'commissioncashserviceimpl.java':31B,79C 'contact':125C 'contini':109C 'control':4A,58B,90C 'cve':10A,13A 'deliveri':110C 'detail':113C 'disclosur':129C 'earli':126C 'element':71C 'file':78C 'flaw':23B 'found':62C 'fuintcat':1A,17B,29B,65C 'fuintcatering':16A 'function':27B,74C 'fushengqian':64C 'host':21B 'improp':2A,88C 'launch':95C 'let':32B 'manipul':35B,81C 'may':46B 'possibl':93C 'product':100C 'proper':40B 'provid':108C 'record':54B 'releas':106C,118C 'remot':44B,98C 'respond':133C 'result':86C 'roll':105C 'self':20B 'self-host':19B 'status':8A,37B,53B,85C 'take':101C 'therefor':111C 'updat':9A,117C 'updatecommissioncash':26B,75C 'vendor':123C 'version':112C 'vulner':60C 'way':136C 'without':39B","nicknames":[],"mitigations":[],"who_affected":"Teams that run fuintCatering from source, including rolling deployments of the project, are potentially exposed because the vulnerable version range covers all releases up to a single commit. The sources do not describe the specific configuration or authentication requirements, and the vendor has not responded to the disclosure. Deployments that do not expose the commission cash endpoints to untrusted callers are likely less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["fuintcatering"],"ptokens":["fuintcatering"],"labels":["fuintcatering","medium","other","selfhosted","vendor"],"campaign_type":null,"search_a":"'-124569':12A,15A '-2026':11A,14A 'access':3A 'cash':7A 'commiss':6A 'control':4A 'cve':10A,13A 'fuintcat':1A 'fuintcatering':16A 'improp':2A 'status':8A 'updat':9A","search_b":"'abl':48B 'access':41B 'argument':38B 'attack':45B 'caller':34B 'cash':52B 'chang':50B 'check':42B 'commiss':51B 'commissioncashserviceimpl.java':31B 'control':58B 'flaw':23B 'fuintcat':17B,29B 'function':27B 'host':21B 'let':32B 'manipul':35B 'may':46B 'proper':40B 'record':54B 'remot':44B 'self':20B 'self-host':19B 'status':37B,53B 'updatecommissioncash':26B 'without':39B","search_c":"'6d054f5788ac8645eb491f79242bb8a625efc133':68C 'access':89C 'affect':70C,115C 'approach':103C 'argument':84C 'attack':97C 'avail':121C 'commissioncashserviceimpl.java':79C 'contact':125C 'contini':109C 'control':90C 'deliveri':110C 'detail':113C 'disclosur':129C 'earli':126C 'element':71C 'file':78C 'found':62C 'fuintcat':65C 'function':74C 'fushengqian':64C 'improp':88C 'launch':95C 'manipul':81C 'possibl':93C 'product':100C 'provid':108C 'releas':106C,118C 'remot':98C 'respond':133C 'result':86C 'roll':105C 'status':85C 'take':101C 'therefor':111C 'updat':117C 'updatecommissioncash':75C 'vendor':123C 'version':112C 'vulner':60C 'way':136C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T06:17:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124569","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124569","severity":null,"published_at":"2026-11-09T06:17:57+00:00","modified_at":"2026-11-09T06:17:58+00:00","first_seen_at":"2026-11-09T06:25:02+00:00","fetched_at":"2026-11-09T06:25:02+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}