| Title | fushengqian fuintCatering up to 06e744dd Improper Access Controls |
|---|
| Description | A vulnerability has been found in fushengqian fuintCatering. Affected is the function agreeRefund of RefundServiceImpl, reached via the backend endpoint BackendRefundController doRefund/save. agreeRefund validates the after-sales record and the refund amount cap but does not check the order's status or payStatus; it transitions the order to REFUND and returns points, stock and balance again. As a result, an unpaid, cancelled or already-refunded order can be "agreed" and have points, stock and balance returned a second time, causing a financial discrepancy. The attack can be launched remotely. Authentication as a backend account with the refund:edit permission is required. Suggested fix: verify the order status/payStatus is refund-eligible before agreeRefund proceeds. |
|---|
| Source | ⚠️ https://github.com/fushengqian/fuintCatering/blob/06e744dd5d1f1a754861cc322fbb84b7d5edd25b/fuintBackend/fuint-application/src/main/java/com/fuint/module/backendApi/controller/order/BackendRefundController.java#L118-L155 |
|---|
| User | Y1Daa (UID 102157) |
|---|
| Submission | 10/15/2026 10:27 (24 days ago) |
|---|
| Moderation | 11/08/2026 15:55 (24 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 432900 [fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133 Refund Agreement RefundServiceImpl.agreeRefund access control] |
|---|
| Points | 20 |
|---|