fuint CVE-2026-124565

Requires a valid low-privileged authenticated session on the target fuint instance (PR:L), from which the attacker invokes the confirm action of MerchantOrderController.java in the Order Verification component; the missing/weak access-control check on that endpoint is the core prerequisite. Exploitation is limited by the need for an existing account and by the narrow impact (unauthorized order-verification actions, integrity only - no confidentiality or availability effect). No specific non-default configuration or user interaction is indicated, but the exact code-level trigger beyond improper access control is not described in the available sources. Affected version cannot be scoped because the product is a rolling release with no version information.

This is a medium-severity authorization flaw, not a high-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows network-reachable, low-complexity exploitation, but PR:L means a valid low-privileged account is required - so this is privilege escalation/authorization abuse by an authenticated user, not anonymous remote compromise. Impact is narrow: only VI:L (low integrity) is set, with confidentiality and availability marked N, consistent with improperly authorized order-verification actions rather than data theft or service disruption. The vuln.today decision label is 'this_month', which aligns with the moderate 5.3 score and argues against urgent patching. No EPSS score, no CISA KEV listing, and no confirmed public exploit were supplied, so there is no signal of active or widespread exploitation. The reporting is single-source (VulDB) and the vendor did not respond, so affected/fixed versions cannot be pinned down. Net: a real but bounded authorization weakness worth scheduled remediation, not a drop-everything issue.

A user holding a low-privileged authenticated account on a fuint deployment sends a request to the order-confirmation endpoint handled by the confirm function in MerchantOrderController.java. Because access controls on that Order Verification action are improperly enforced, the actor verifies or confirms an order they are not authorized to act on, producing a limited integrity impact. No public exploit code was identified, and the precise trigger beyond the missing access-control check is not described in the available sources.