CVE-2026-15752 Details
Description
A vulnerability was found in zhinianboke xianyu-auto-reply up to dcb445ad97816ad65299a7580ee0c8c8f929da84. Affected is an unknown function of the file /api/v1/users/ of the component Backend User Endpoint. Performing a manipulation results in missing authorization. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The patch is named 19fc3282a1bb78a05c34945c088525d20e081cbd. Applying a patch is the recommended action to fix this issue.
A vulnerability exists in the zhinianboke xianyu-auto-reply application, specifically within the backend user endpoint of the API. This vulnerability allows for unauthorized actions such as modifying user roles and statuses, bypassing CAPTCHA requirements, and manipulating withdrawal approval processes. The issue arises from several API endpoints that lack proper authentication and authorization checks, particularly those related to user management and financial transactions.
Users are advised to update to the latest version of zhinianboke xianyu-auto-reply, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 14, 2026CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zhinianboke/xianyu-auto-reply/ | [email protected] | Source CodeVendor |
| https://github.com/zhinianboke/xianyu-auto-reply/commit/19fc3282a1bb78a05c34945c088525d20e081cbd | [email protected] | Source CodeVendor |
| https://github.com/zhinianboke/xianyu-auto-reply/issues/192 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://vuldb.com/cve/CVE-2026-15752 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/856716 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/378334 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/378334/cti | [email protected] | AdvisoryContent Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| zhinianboke xianyu-auto-reply | <= dcb445ad97816ad65299a7580ee0c8c8f929da84 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | New CVE Received | [email protected] |