Description
A vulnerability was determined in zhinianboke xianyu-auto-reply on Server. Affected by this vulnerability is an unknown functionality of the file /api/v1/payment/withdraw/review?action=approve. Executing a manipulation can lead to trusting http permission methods on the server side. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 19fc3282a1bb78a05c34945c088525d20e081cbd. It is best practice to apply a patch to resolve this issue.
Published: 2026-07-14
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability exists in the xianyu-auto-reply server application that allows an attacker to manipulate the /api/v1/payment/withdraw/review endpoint with the action=approve parameter. The flaw causes the server to trust HTTP permission methods supplied by the client, which can bypass intended access controls. This gives an attacker the ability to perform privileged actions, effectively escalating privileges. The weakness corresponds to CWE‑650.

Affected Systems

The affected product is zhinianboke xianyu-auto-reply. No release or version number is specified; the issue seems to affect any instance containing the unpatched /api/v1/payment/withdraw/review endpoint.

Risk and Exploitability

The CVSS base score of 5.3 indicates moderate risk, and the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA KEV. An attacker can remotely exploit the flaw by sending crafted HTTP requests to the endpoint; no additional prerequisites are clearly documented.

Generated by OpenCVE AI on July 31, 2026 at 04:19 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the patch from commit 19fc3282a1bb78a05c34945c088525d20e081cbd or upgrade to the latest release that contains the fix.
  • Restrict access to the /api/v1/payment/withdraw/review endpoint and enforce proper HTTP method checks so that only authorized methods and users can invoke action=approve.
  • Harden the server configuration to prevent HTTP method spoofing and ensure all permission checks reference server-side validated states.
  • Monitor application logs for unexpected requests to the withdraw review endpoint and investigate any anomalous activity.

Generated by OpenCVE AI on July 31, 2026 at 04:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 15 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in zhinianboke xianyu-auto-reply on Server. Affected by this vulnerability is an unknown functionality of the file /api/v1/payment/withdraw/review?action=approve. Executing a manipulation can lead to trusting http permission methods on the server side. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 19fc3282a1bb78a05c34945c088525d20e081cbd. It is best practice to apply a patch to resolve this issue.
Title zhinianboke xianyu-auto-reply review approve trusting http permission methods on the server side
First Time appeared Zhinianboke
Zhinianboke xianyu-auto-reply
Weaknesses CWE-650
CPEs cpe:2.3:a:zhinianboke:xianyu-auto-reply:*:*:*:*:*:*:*:*
Vendors & Products Zhinianboke
Zhinianboke xianyu-auto-reply
References
Metrics cvssV2_0

{'score': 5.5, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 5.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Zhinianboke Xianyu-auto-reply
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-15T18:14:14.492Z

Reserved: 2026-07-14T15:51:28.328Z

Link: CVE-2026-15753

cve-icon Vulnrichment

Updated: 2026-07-15T18:14:09.259Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T04:30:03Z

Weaknesses
  • CWE-650

    Trusting HTTP Permission Methods on the Server Side