EUVD-2026-119808Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
ExploitSend manipulated request to order receipt endpoint
-
ExecutionTrigger improper state handling (CWE-371)
-
ImpactAlter order/receipt state (limited integrity impact)
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Requires a valid low-privilege authenticated session on the fuint application (CVSS PR:L), after which the vulnerable 'receipt' function in ClientOrderController.java is reachable remotely over the network with low complexity and no user interaction (AV:N/AC:L/AT:N/UI:N). Limiting factors: exploitation is gated by authentication (an attacker must first obtain or register a low-privilege account), impact is confined to integrity of the vulnerable system only (no confidentiality or availability loss and no scope change), and the specific configuration or input needed to trigger the improper state is not described in the available sources. No fixed release is identified because the vendor ships a rolling release and did not respond to the disclosure. |
| Impact | This is a moderate-severity, low-priority issue that should not displace higher-risk work. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a remotely reachable flaw with low attack complexity but requiring prior low-privilege authentication (PR:L), and the impact is limited to integrity of the vulnerable system only (VI:L; VC:N, VA:N, SC/SI/SA:N) - no confidentiality or availability loss and no scope change. VulDB assigned a base score of 5.3 (medium). There is no EPSS score, no CISA KEV listing, and no verified public exploit code provided - only VulDB's own vulnerability, CTI, and submission pages, which are catalog references rather than working exploits - so exploitation is: no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', consistent with a medium, non-emergency item. Two data signals conflict and should be noted: the input Tag 'Information Disclosure' contradicts the CVSS vector, which shows VC:N (no confidentiality impact) and VI:L (integrity only), and the CWE is CWE-371 (state issue), not a disclosure weakness - treat the integrity-only reading as authoritative. Overall this is a genuine-but-minor authenticated integrity flaw, not a high-urgency priority. |
| Exploit ScenarioDerived | An attacker who already holds a valid low-privilege account on a fuint deployment sends a manipulated request to the order 'receipt' handler in ClientOrderController.java, triggering an improper state condition that lets them alter order/receipt state they should not be able to modify. The precise manipulation and the resulting state change are not described in the available sources. No verified public exploit code exists for this issue. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 09, 2026
An integrity-only state manipulation flaw in the fuint order-management platform lets an authenticated low-privilege user alter application state remotely by manipulating the 'receipt' function in ClientOrderController.java. All builds of fuint up to commit 36cc31b08d77facc94e8959afa02224891b4fe5f are affected, and because the project ships a rolling release the vendor does not publish version boundaries; the vendor was contacted about the disclosure and did not respond. Scoring is moderate (CVSS v4.0 5.3; assessed v3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, integrity impact only), no public exploit code has been identified at time of analysis, and exploitation requires a valid low-privilege account plus knowledge of the input needed to reach the improper state - which the available sources do not describe.
RemediationAI
No vendor-released patch or fixed version has been identified at time of analysis: fuint follows a rolling release model, the disclosure pins affected code to commit 36cc31b08d77facc94e8959afa02224891b4fe5f, and the maintainer did not respond to the report, so there is no advisory to track and no CVE-linked upgrade target to cite. Operators should pull the latest upstream code once a fix lands (monitor https://vuldb.com/vuln/432899 for updates) and review their own fork or deployment for modification of the ClientOrderController receipt handler. Because the only reliable precondition is a valid low-privilege account (CVSS PR:L), the most effective compensating control is to restrict who can reach the client-facing order endpoints - gate registration and account provisioning, and place the receipt action behind stricter authorization checks or an authenticated reverse-proxy/WAF rule so that only known, vetted accounts can invoke it; the trade-off is that legitimate self-service or partner integrations using that endpoint will break or require an allow-list. Reducing the privileges granted to ordinary client accounts limits the state an attacker can reach through the handler, at the cost of some functionality for normal users. Given the integrity-only, low-severity profile and absence of public exploit code, these controls are proportionate; there is no basis in the available data for a more specific technical workaround.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
fuint is a Java-based membership and order management application whose HTTP layer is built on Spring-style MVC controllers; the vulnerable entry point is the 'receipt' handler in ClientOrderController.java, which is reachable over the network from the client-facing application. The assigned weakness, CWE-371 (State Issues), is a broad category covering defects in how an application tracks, transitions or persists state - here the receipt operation can be driven into an improper state by a crafted request, producing a limited integrity impact on the vulnerable component only (no confidentiality or availability loss and no scope change per the assessed vector). The specific configuration, parameter or sequence required to trigger the improper state is not described in the available sources, so the flaw cannot be reproduced from public data alone. The CPE cpe:2.3:a:fushengqian:fuint:*:*:*:*:*:*:*:* reflects that no version range can be enumerated: fuint uses a rolling release model, so the disclosure pins affected code only to the commit 36cc31b08d77facc94e8959afa02224891b4fe5f rather than to tagged versions.
Know when Fuint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Remote network endpoint with low complexity but gated by a low-privilege account (PR:L); CWE-371 state issue yields limited integrity impact only, so C:N/I:L/A:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A flaw has been found in fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f. This issue affects the function receipt of the file ClientOrderController.java. Executing a manipulation can lead to state issue. The attack may be performed from remote. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An insecure direct object reference in Fuint through commit 57ec018 lets authenticated members retrieve other members' b
Improper enforcement of behavioral workflow in the Alipay callback handler (aliPayCallback in ClientPayController.java)
Improper access control in fuint's MerchantOrderController confirm action allows an authenticated low-privileged user to
GitHub PoC
Exploit-DB