---
id: "CVE-2026-124569"
page: "https://infrastack.ai/live/CVE-2026-124569"
kind: "vulnerability"
aliases: ["CVE-2026-124569"]
title: "fuintCatering: improper access control in commission cash status update"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "fuintCatering", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["fuintcatering", "other", "self-hosted"]
not_affected_if: []
published_at: "2026-11-09T06:17:57+00:00"
first_seen_at: "2026-11-09T06:25:02+00:00"
updated_at: "2026-11-09T06:26:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124569", "first_seen_at": "2026-11-09T06:25:02+00:00"}]
exploit_sources: []
---

# fuintCatering: improper access control in commission cash status update

Link for people: https://infrastack.ai/live/CVE-2026-124569 (this .md is for agents)

A flaw in the updateCommissionCash function of fuintCatering's CommissionCashServiceImpl.java lets a caller manipulate the Status argument without proper access checks. A remote attacker may be able to change commission cash status records they should not control.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:fuintCatering affected range not listed fixed no fixed version listed

## Timeline

- 2026-11-09T06:25:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124569

## From the sources

A vulnerability was found in fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133. The affected element is the function updateCommissionCash of the file CommissionCashServiceImpl.java. The manipulation of the argument Status results in improper access controls. It is possible to launch the attack remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_