xianyu-auto-reply CVE-2026-15753

The passive exploitation path requires that the xianyu-auto-reply instance sends payment withdrawal review links via email and that the recipient's email client or mail security gateway automatically prefetches embedded URLs - a common behavior in Microsoft Outlook with Safe Links, Apple Mail, and various enterprise mail security products. The endpoint /api/v1/payment/withdraw/review?action=approve must be reachable from the network location of the prefetching agent. Direct intentional abuse by an authenticated low-privilege user is constrained by the requirement to possess a valid, presumably randomly generated review token bound to a specific withdrawal request ID. Exploitation is not possible against default unauthenticated states; low-level authentication (PR:L per CVSS 4.0) is required, meaning the prefetch path operates under the legitimate session or token context embedded in the review URL.

The CVSS 4.0 base score of 2.1 reflects limited scope: integrity and availability are both Low, with no confidentiality impact, and PR:L indicates low-privilege authentication is required. The E:P supplemental metric confirms a publicly available proof-of-concept, raising the practical exploitation likelihood above the base score alone. No EPSS data was provided in the input, and no CISA KEV entry is present. Despite the low numeric score, the financial integrity implications are contextually elevated: the primary real-world attack path - automated email link prefetching triggering an admin-level payment approval - is passive, requires no deliberate adversarial action by an authenticated user, and may go undetected. Exploitation is constrained by the requirement for a valid, presumably randomly generated review token tied to a specific withdrawal ID, which limits opportunistic mass exploitation. The impact is bounded to the specific deployment's financial transaction integrity, not broad system compromise.

An administrator receives an automated email notification containing a one-click approval link for a pending payment withdrawal, pointing to /api/v1/payment/withdraw/review?action=approve&id=42&token=<valid_token>. Before the administrator opens the message, the mail client or enterprise email security gateway automatically issues a GET request to prefetch the URL, and the unpatched server immediately executes the withdrawal approval. The financial transaction is committed without any human review, and the administrator sees no pending action when they eventually open the email. A public proof-of-concept has been disclosed, lowering the bar for intentional exploitation of this same GET-based approval path.