CVE-2026-15752: xianyu-auto-reply Auth Bypass Vulnerability

CVE-2026-15752 Overview

CVE-2026-15752 is a missing authorization vulnerability [CWE-862] in the zhinianboke xianyu-auto-reply project, affecting code up to commit dcb445ad97816ad65299a7580ee0c8c8f929da84. The flaw resides in the Backend User Endpoint exposed at /api/v1/users/. An attacker can manipulate requests to this endpoint remotely without prior authentication or user interaction. The exploit has been publicly disclosed, increasing the risk of opportunistic abuse. Because the project uses a rolling release model, no discrete affected version identifiers are published. The maintainer addressed the issue in patch commit 19fc3282a1bb78a05c34945c088525d20e081cbd.

Critical Impact
Remote, unauthenticated actors can invoke a backend user management endpoint that lacks proper authorization checks, resulting in limited confidentiality, integrity, and availability impact on user data.

Affected Products

zhinianboke/xianyu-auto-reply repository builds up to commit dcb445ad97816ad65299a7580ee0c8c8f929da84
Backend User Endpoint component (/api/v1/users/)
All rolling releases predating patch commit 19fc3282a1bb78a05c34945c088525d20e081cbd

Discovery Timeline

2026-07-14 - CVE-2026-15752 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15752

Vulnerability Analysis

The vulnerability is a missing authorization flaw [CWE-862] in a FastAPI-based backend service. The /api/v1/users/ route handles user management operations but fails to verify that the caller has appropriate role or ownership scope before executing sensitive actions. Because the endpoint is exposed over the network and requires no authentication or user interaction, an attacker can invoke it directly with crafted HTTP requests. The public disclosure of exploitation details lowers the barrier to abuse.

Root Cause

The root cause is the absence of authorization checks on a backend user route. The patch strengthens the authentication and authorization layer in backend-web/app/api/routes/auth.py and adjusts related service calls in backend-web/app/api/routes/distribution.py to enforce ownership scope through resolve_owner_scope(current_user) and propagate authorization failure messages. Without these checks, any caller reaching the endpoint could exercise privileged user-management logic.

Attack Vector

The attack originates from the network and does not require credentials or user interaction. An attacker sends crafted HTTP requests directly to the /api/v1/users/ endpoint of an exposed xianyu-auto-reply deployment. Successful manipulation grants limited access to user records or state changes that should be restricted to administrators or the resource owner.

python

# Security patch excerpt from backend-web/app/api/routes/auth.py
# Source: https://github.com/zhinianboke/xianyu-auto-reply/commit/19fc3282a1bb78a05c34945c088525d20e081cbd
from fastapi import APIRouter, Depends, HTTPException, Request, status
from sqlalchemy.ext.asyncio import AsyncSession

from app.api import deps
from app.core.security import decode_token
from common.models.user import User, UserRole, UserStatus
from common.schemas.auth import LoginRequest, LoginResponse, VerifyResponse
from common.schemas.common import ApiResponse
from common.schemas.user import UserCreate, UserPublic
from app.services.auth import AuthService

python

# Ownership scope enforcement in backend-web/app/api/routes/distribution.py
# Source: https://github.com/zhinianboke/xianyu-auto-reply/commit/19fc3282a1bb78a05c34945c088525d20e081cbd
_, is_admin = resolve_owner_scope(current_user)
update_data = data.model_dump(exclude_unset=True)
success, message = await service.update_dock_record(
    record_id, current_user.id, is_admin=is_admin, **update_data
)
if not success:
    return ApiResponse(success=False, message=message)
return ApiResponse(success=True, message="更新成功")

Detection Methods for CVE-2026-15752

Indicators of Compromise

Unauthenticated or anomalous HTTP requests targeting the /api/v1/users/ path on xianyu-auto-reply hosts.
Repeated 200-status responses to /api/v1/users/ requests originating from clients that never issued a prior /login call.
Unexpected creation, modification, or enumeration of user records in application logs without matching admin session activity.

Detection Strategies

Enable verbose access logging on the FastAPI backend and alert on requests to /api/v1/users/ that lack a valid session token or Authorization header.
Correlate application-level audit logs with reverse-proxy logs to identify direct calls that bypass normal user workflows.
Deploy a Web Application Firewall (WAF) rule to log and inspect all traffic to /api/v1/users/* for unauthenticated calls.

Monitoring Recommendations

Track request rate and source IP diversity for the /api/v1/users/ endpoint and alert on spikes from single hosts.
Monitor database audit trails for user table INSERT, UPDATE, and DELETE operations that do not map to an authenticated administrator session.
Review outbound egress and follow-on activity from the application host for signs of post-exploitation such as lateral movement or credential harvesting.

How to Mitigate CVE-2026-15752

Immediate Actions Required

Update xianyu-auto-reply deployments to include patch commit 19fc3282a1bb78a05c34945c088525d20e081cbd or later.
Restrict network exposure of the backend so that /api/v1/users/ is not reachable from untrusted networks.
Audit user records and dock records for unauthorized changes made prior to patching.

Patch Information

The maintainer published a fix in commit 19fc3282a1bb78a05c34945c088525d20e081cbd. The patch introduces ownership scope resolution via resolve_owner_scope(current_user) and returns authorization failure messages from service calls. Because the project follows a rolling release model, operators must redeploy from a source tree that includes this commit. Additional context is available in the GitHub Issue Tracker and the VulDB CVE Record.

Workarounds

Place the application behind an authenticating reverse proxy and require a valid session cookie or bearer token before forwarding requests to /api/v1/users/.
Add a WAF or ingress rule that blocks direct external access to /api/v1/users/ and permits only administrative source IP ranges.
Temporarily disable the Backend User Endpoint route in the FastAPI router until the patched build is deployed.

bash

# Example nginx configuration to restrict access to the vulnerable endpoint
location /api/v1/users/ {
    allow 10.0.0.0/8;      # trusted admin subnet
    deny  all;
    proxy_pass http://xianyu_backend;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
}