Fuintcatering
Monthly
Authenticated low-privileged users of fuintCatering can change commission-cash Status values through the updateCommissionCash function because the application does not properly enforce access control on that argument. The issue is rated CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) and affects deployments built through commit 6d054f5788ac8645eb491f79242bb8a625efc133; the project uses rolling releases, so no version-specific fixed release is published. No public exploit was identified at time of analysis.
Improper access control in the Refund Agreement component of fuintCatering (fushengqian) lets any authenticated low-privilege account manipulate the refund-approval action handled by RefundServiceImpl.agreeRefund, altering refund records while leaving confidentiality and availability untouched. The project ships as a rolling release with no version detail, the maintainers did not respond to the disclosure, and no vendor patch or public exploit was identified at time of analysis, so any deployment built at or near commit 6d054f5788ac8645eb491f79242bb8a625efc133 should be treated as unpatched. Scored 5.3 (medium) and prioritised as a this-month item, this is a modest-priority authorization defect rather than an emergency.
Authenticated low-privileged users of fuintCatering can change commission-cash Status values through the updateCommissionCash function because the application does not properly enforce access control on that argument. The issue is rated CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) and affects deployments built through commit 6d054f5788ac8645eb491f79242bb8a625efc133; the project uses rolling releases, so no version-specific fixed release is published. No public exploit was identified at time of analysis.
Improper access control in the Refund Agreement component of fuintCatering (fushengqian) lets any authenticated low-privilege account manipulate the refund-approval action handled by RefundServiceImpl.agreeRefund, altering refund records while leaving confidentiality and availability untouched. The project ships as a rolling release with no version detail, the maintainers did not respond to the disclosure, and no vendor patch or public exploit was identified at time of analysis, so any deployment built at or near commit 6d054f5788ac8645eb491f79242bb8a625efc133 should be treated as unpatched. Scored 5.3 (medium) and prioritised as a this-month item, this is a modest-priority authorization defect rather than an emergency.