Junglewise Threat Intelligence

CVE-2026-15753: zhinianboke xianyu-auto-reply improper authorization in withdrawal review

CVE-2026-15753 · Severity: medium · CVSS 5.4 · Published 2026-07-14

Executive brief

A security vulnerability exists in xianyu-auto-reply, an automated customer service system for the Xianyu platform. The software fails to properly verify permissions for certain administrative actions, such as approving payment withdrawals. This could allow an attacker to bypass intended security restrictions and perform unauthorized financial or administrative operations, potentially leading to financial loss or unauthorized account changes.

Technical details

The vulnerability is classified as CWE-650 (Trusting HTTP Permission Methods on the Server Side) and involves improper authorization checks in the '/api/v1/payment/withdraw/review' endpoint. Specifically, the application may trust HTTP methods or parameters (like 'action=approve') without sufficient server-side validation of the requester's privileges. Related issues in the same codebase include unauthenticated access to user update endpoints, which could allow an attacker to escalate privileges to 'ADMIN'. The vulnerability can be exploited remotely by an authenticated user with low privileges. A patch has been released in commit 19fc3282a1bb78a05c34945c088525d20e081cbd.

Affected products

  • zhinianboke xianyu-auto-reply up to commit 04580d6490b4731d0055f29736930d8cc59b60d6

Timeline

  • 2026-06-13: patched: Commit 19fc3282a1bb78a05c34945c088525d20e081cbd released to improve system security.
  • 2026-07-14: advisory: CVE-2026-15753 published.

References

Related threats