CVE-2026-15753

zhinianboke xianyu-auto-reply review approve trusting http permission methods on the server side

View on CVE.org
Published Jul 14, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was determined in zhinianboke xianyu-auto-reply on Server. Affected by this vulnerability is an unknown functionality of the file /api/v1/payment/withdraw/review?action=approve. Executing a manipulation can lead to trusting http permission methods on the server side. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 19fc3282a1bb78a05c34945c088525d20e081cbd. It is best practice to apply a patch to resolve this issue.

Analysis

AI-generated

Technical impact

A vulnerability exists in the xianyu-auto-reply server application that allows an attacker to manipulate the /api/v1/payment/withdraw/review endpoint with the action=approve parameter. The flaw causes the server to trust HTTP permission methods supplied by the client, which can bypass intended access controls. This gives an attacker the ability to perform privileged actions, effectively escalating privileges. The weakness corresponds to CWE‑650.

Affected Systems

The affected product is zhinianboke xianyu-auto-reply. No release or version number is specified; the issue seems to affect any instance containing the unpatched /api/v1/payment/withdraw/review endpoint.

Risk and Exploitability

The CVSS base score of 5.3 indicates moderate risk, and the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA KEV. An attacker can remotely exploit the flaw by sending crafted HTTP requests to the endpoint; no additional prerequisites are clearly documented.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the patch from commit 19fc3282a1bb78a05c34945c088525d20e081cbd or upgrade to the latest release that contains the fix.
  • Restrict access to the /api/v1/payment/withdraw/review endpoint and enforce proper HTTP method checks so that only authorized methods and users can invoke action=approve.
  • Harden the server configuration to prevent HTTP method spoofing and ensure all permission checks reference server-side validated states.
  • Monitor application logs for unexpected requests to the withdraw review endpoint and investigate any anomalous activity.

Generated by OpenCVE AI on July 31, 2026 at 04:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was determined in zhinianboke xianyu-auto-reply on Server. Affected by this vulnerability is an unknown functionality of the file /api/v1/payment/withdraw/review?action=approve. Executing a manipulation can lead to trusting http permission methods on the server side. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 19fc3282a1bb78a05c34945c088525d20e081cbd. It is best practice to apply a patch to resolve this issue.
Title zhinianboke xianyu-auto-reply review approve trusting http permission methods on the server side
First Time appeared Zhinianboke
Zhinianboke xianyu-auto-reply
Weaknesses CWE-650
CPEs cpe:2.3:a:zhinianboke:xianyu-auto-reply:*:*:*:*:*:*:*:*
Vendors & Products Zhinianboke
Zhinianboke xianyu-auto-reply
References
Metrics cvssV2_0

{'score': 5.5, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 5.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-650

    Trusting HTTP Permission Methods on the Server Side

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jul 15, 2026, 6:14 PM
Reserved
Jul 14, 2026, 3:51 PM

View source JSON

Updated
Jul 15, 2026, 6:14 PM

JSON

Status
Deferred
Published
Jul 14, 2026, 11:17 PM
Modified
Oct 24, 2026, 10:10 PM

View source JSON

No data.

Updated
Jul 31, 2026, 4:30 AM

JSON