EUVD-2026-44572
GHSA-qfmv-m5q8-c558
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint with no privileges required (PR:N per missing auth); low complexity; limited and symmetric CIA impact matching CVSS 4.0 VC/VI/VA:L with no scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in zhinianboke xianyu-auto-reply up to dcb445ad97816ad65299a7580ee0c8c8f929da84. Affected is an unknown function of the file /api/v1/users/ of the component Backend User Endpoint. Performing a manipulation results in missing authorization. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The patch is named 19fc3282a1bb78a05c34945c088525d20e081cbd. Applying a patch is the recommended action to fix this issue.
AnalysisAI
Missing authorization on the /api/v1/users/ backend user endpoint in xianyu-auto-reply allows remote unauthenticated attackers to access or manipulate user account data without any credentials. The flaw (CWE-862) affects all commits up to dcb445ad97816ad65299a7580ee0c8c8f929da84 in this FastAPI-based Python backend for automating Xianyu marketplace replies. A public exploit exists (CVSS 4.0 E:P), though no active exploitation is confirmed in CISA KEV; the vendor-issued patch commit is the recommended remediation given the project's rolling release model.
Technical ContextAI
xianyu-auto-reply is a self-hosted Python backend built on FastAPI, designed to automate replies on Xianyu (Idle Fish), Alibaba's secondhand marketplace platform. The commit diff confirms FastAPI route decorators and a dependency-injection authentication pattern (deps.get_current_active_user). The root cause is CWE-862 (Missing Authorization): the /api/v1/users/ endpoint failed to enforce an authorization check before processing requests, enabling unauthorized access. The patch commit (19fc3282a1bb78a05c34945c088525d20e081cbd) removes an OAuth2-compatible /token endpoint from backend-web/app/api/routes/auth.py that appears to have provided an unintended unauthenticated token acquisition path, and also hardens the payment withdrawal approval flow in payment.py by converting a state-mutating GET handler into a POST-confirmed flow to prevent CSRF-style abuse by link scanners or email prefetchers. No CPE string was available in the provided data.
RemediationAI
Apply patch commit 19fc3282a1bb78a05c34945c088525d20e081cbd from https://github.com/zhinianboke/xianyu-auto-reply/commit/19fc3282a1bb78a05c34945c088525d20e081cbd and pull the latest HEAD from the main branch, as the rolling release model means no discrete patched release version exists. If immediate patching is not possible, restrict network access to the /api/v1/users/ endpoint at the reverse proxy or firewall layer to trusted IP ranges only - note this will break any legitimate remote user management workflows depending on that endpoint. Additionally, audit other API routes for missing Depends(deps.get_current_active_user) guards in the FastAPI route definitions, as the same pattern may affect sibling endpoints. The associated issue is at https://github.com/zhinianboke/xianyu-auto-reply/issues/192.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today