CVE-2026-15752

HighCVSS 7.3

Published: 14/07/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

A vulnerability was found in the Backend User Endpoint component of xianyu-auto-reply, involving missing authorization. The attack can be initiated remotely via manipulation of the /api/v1/users/ file. The exploit has been made public.

Risk Assessment

Missing authorization in the API endpoint could allow unauthorized users to access sensitive data or perform administrative actions, posing a serious risk to system confidentiality and integrity.

Recommendation

Apply the patch identified as 19fc3282a1bb78a05c34945c088525d20e081cbd immediately. Due to the rolling release model, ensure regular updates to the latest version.

Other vulnerabilities in xianyu-auto-reply

CVE-2026-15753Medium
A vulnerability was found in the zhinianboke xianyu-auto-reply server application in the file /api/v1/payment/withdraw/review?action=approve. An unknown functionality allows remote manipulation leading to trusting HTTP permission methods on the server side. The exploit has been publicly disclosed and may be used.

Original NVD description (English source)

A vulnerability was found in zhinianboke xianyu-auto-reply up to dcb445ad97816ad65299a7580ee0c8c8f929da84. Affected is an unknown function of the file /api/v1/users/ of the component Backend User Endpoint. Performing a manipulation results in missing authorization. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The patch is named 19fc3282a1bb78a05c34945c088525d20e081cbd. Applying a patch is the recommended action to fix this issue.