CVE-2026-15752: Missing Authorization in zhinianboke xianyu-auto-reply
CVE-2026-15752 is a medium severity vulnerability in the zhinianboke xianyu-auto-reply product affecting the backend user endpoint at /api/v1/users/. It allows remote attackers to bypass authorization due to missing authorization checks. The product uses a rolling release model, so specific affected versions are not clearly defined. A patch identified by commit 19fc3282a1bb78a05c34945c088525d20e081cbd is recommended to fix the issue.
AI Analysis
Technical Summary
This vulnerability in zhinianboke xianyu-auto-reply up to commit dcb445ad97816ad65299a7580ee0c8c8f929da84 involves missing authorization checks in an unknown function within the /api/v1/users/ backend user endpoint. This flaw allows remote attackers to perform unauthorized actions. The product's rolling release model complicates precise version identification. A patch exists under commit 19fc3282a1bb78a05c34945c088525d20e081cbd to address the issue. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.
Potential Impact
The vulnerability enables remote attackers to bypass authorization controls on the backend user endpoint, potentially allowing unauthorized access or manipulation of user-related functionality. The impact is rated medium based on the CVSS 4.0 score of 6.9, indicating limited but significant risk to confidentiality, integrity, and availability.
Mitigation Recommendations
A patch identified by commit 19fc3282a1bb78a05c34945c088525d20e081cbd is available and should be applied to remediate this vulnerability. Since the product uses a rolling release model, users should update to the latest version that includes this patch. No vendor advisory explicitly states otherwise.
CVE-2026-15752: Missing Authorization in zhinianboke xianyu-auto-reply
Description
CVE-2026-15752 is a medium severity vulnerability in the zhinianboke xianyu-auto-reply product affecting the backend user endpoint at /api/v1/users/. It allows remote attackers to bypass authorization due to missing authorization checks. The product uses a rolling release model, so specific affected versions are not clearly defined. A patch identified by commit 19fc3282a1bb78a05c34945c088525d20e081cbd is recommended to fix the issue.
CVSS v4.0
Score 6.9medium
Affected software
cpe:2.3:a:zhinianboke:xianyu-auto-reply:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in zhinianboke xianyu-auto-reply up to commit dcb445ad97816ad65299a7580ee0c8c8f929da84 involves missing authorization checks in an unknown function within the /api/v1/users/ backend user endpoint. This flaw allows remote attackers to perform unauthorized actions. The product's rolling release model complicates precise version identification. A patch exists under commit 19fc3282a1bb78a05c34945c088525d20e081cbd to address the issue. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.
Potential Impact
The vulnerability enables remote attackers to bypass authorization controls on the backend user endpoint, potentially allowing unauthorized access or manipulation of user-related functionality. The impact is rated medium based on the CVSS 4.0 score of 6.9, indicating limited but significant risk to confidentiality, integrity, and availability.
Mitigation Recommendations
A patch identified by commit 19fc3282a1bb78a05c34945c088525d20e081cbd is available and should be applied to remediate this vulnerability. Since the product uses a rolling release model, users should update to the latest version that includes this patch. No vendor advisory explicitly states otherwise.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-07-14T15:51:25.852Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a56b92768715ace4351a78f
Added to database: 07/14/2026, 22:33:11 UTC
Last enriched: 07/21/2026, 22:48:09 UTC
Last updated: 08/25/2026, 22:52:09 UTC
Views: 123
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.