fuintCatering CVE-2026-124568

Exploitation requires an authenticated, low-privilege account on the fuintCatering application (CVSS PR:L), after which the attacker targets the Refund Agreement component (RefundServiceImpl.agreeRefund) over the network without user interaction (AV:N/UI:N). The limiting factors are the need for valid authenticated access and the integrity-only impact (VI:L; VC:N/VA:N), meaning the flaw does not expose data or disable the service - it allows unauthorized manipulation of the refund-approval action. No additional non-default configuration is identified in the available sources, and the specific trigger beyond the missing access-control check is not described.

This is a medium-severity authorization flaw with modest real-world priority. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows a network-reachable, low-complexity issue that requires the attacker to already hold some privilege (PR:L), and the impact is limited to integrity only (VI:L) with no confidentiality (VC:N) or availability (VA:N) effect - consistent with an improper access control (CWE-284) weakness in the refund-approval path rather than a full compromise. The vuln.today decision label is 'this_month,' not act_now or emergency, matching the medium score. No EPSS probability, no CISA KEV listing, and no confirmed working exploit code are present in the input, so there is no signal of active or widespread exploitation; absence of these is not evidence of safety but does argue against treating this as an urgent, internet-wide threat. The affected software (fushengqian fuintCatering) is a niche open-source catering/membership system with a small deployment footprint, further lowering aggregate risk. Net: a legitimate issue to patch on a normal cadence for anyone running this product, but not a drop-everything priority. Note one gap - the vendor did not respond to disclosure and the project uses rolling releases, so there is no confirmed fixed version to point remediation at.

An attacker who holds a low-privilege authenticated account on a fuintCatering deployment sends a crafted request to the refund-agreement endpoint backed by RefundServiceImpl.agreeRefund, where missing authorization checks let them approve or manipulate a refund they should not control. No public, verified exploit code is identified in the input, and the low CVSS complexity (AC:L) means no special timing or preconditions are needed once the attacker is authenticated. The impact is limited to integrity of refund data (VI:L), not data theft or service disruption.