fuintCatering EUVD-2026-119810

Exploitation requires an authenticated session with at least low-level privileges on a fuintCatering instance (PR:L), reachable over the network (AV:N), with no user interaction. The specific prerequisite is access to the commission-cash update functionality handled by updateCommissionCash, where the Status argument is not properly access-controlled (CWE-284). Limiting factors: valid credentials are mandatory (not unauthenticated), impact is confined to integrity and availability of commission-cash data (no confidentiality exposure), and because releases are rolling with no published fixed version, exposure depends on the exact commit deployed (up to 6d054f5788ac8645eb491f79242bb8a625efc133). The precise authorization check that is missing is not detailed in the available sources beyond the function and argument named.

This is a moderate, authenticated authorization flaw that does not rise to emergency priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack that nevertheless requires existing low-level privileges (PR:L) - so it is not an unauthenticated internet-wide risk. Impact is explicitly limited: VC:N (no confidentiality loss), VI:L and VA:L (low integrity and availability impact only), yielding a base score of 5.3 (Medium). No EPSS probability is supplied, there is no CISA KEV listing, and no SSVC exploitation sub-decision is provided; the only prioritization signal is the vuln.today 'this_month' decision label, which is consistent with a non-urgent but trackable issue. No confidentiality impact is claimed despite the 'improper access controls' description, so the weakness appears to let an authenticated user alter a Status value they should not control rather than exfiltrate data - note this tension between the CWE-284 label and the C:N rating and verify scope with the code. The 'Authentication Bypass' tag also conflicts with the PR:L vector and the 'improper access controls' wording, which point to broken authorization (post-authentication) rather than authentication bypass. Overall this is a real but lower-priority issue, weakened further by the absence of any vendor response or fixed release.

An authenticated low-privileged user of a fuintCatering deployment sends a crafted request to the commission-cash update flow, manipulating the Status argument that the updateCommissionCash function fails to properly authorize. Because of the missing access control, the attacker changes the state/status of a commission-cash record they should not be able to modify, affecting data integrity and availability. No public exploit code is identified, and the attack requires valid (if low-privileged) credentials.