CVE-2026-15753: Xianyu Auto-Reply RCE Vulnerability

CVE-2026-15753 Overview

CVE-2026-15753 affects the zhinianboke xianyu-auto-reply application on the server side. The vulnerability resides in the /api/v1/payment/withdraw/review?action=approve endpoint. An unspecified functionality within this endpoint trusts HTTP permission methods, allowing remote manipulation by an authenticated attacker with low privileges. The weakness is classified under CWE-650: Trusting HTTP Permission Methods on the Server Side. The exploit has been publicly disclosed, though the impact remains limited to low integrity and availability effects. The maintainer released commit 19fc3282a1bb78a05c34945c088525d20e081cbd to remediate the flaw.

Critical Impact
Remote attackers with low privileges can abuse HTTP method trust in the withdrawal approval endpoint to influence payment review workflows without additional authorization checks.

Affected Products

zhinianboke xianyu-auto-reply (server-side component)
Payment withdrawal review API (/api/v1/payment/withdraw/review)
Versions prior to commit 19fc3282a1bb78a05c34945c088525d20e081cbd

Discovery Timeline

2026-07-14 - CVE-2026-15753 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15753

Vulnerability Analysis

The flaw exists in the payment withdrawal review handler exposed at /api/v1/payment/withdraw/review?action=approve. The endpoint trusts the HTTP method used in incoming requests as an implicit authorization signal. Attackers can leverage this misplaced trust to invoke sensitive actions such as approving withdrawals through unintended HTTP verbs. The vulnerability requires network access and low-privilege authentication, but no user interaction. Because the affected code sits in a financial approval workflow, exploitation can alter withdrawal state or bypass intended review controls.

Root Cause

The application relies on the HTTP method combined with an action query parameter to gate privileged operations. It does not enforce role checks or CSRF-style validation on the server. This design pattern matches [CWE-650], where server-side logic assumes GET, POST, PUT, or DELETE semantics reflect user intent or authorization. The patch commit 19fc3282a1bb78a05c34945c088525d20e081cbd restructures authentication imports and tightens permission scoping in the distribution and auth routes.

Attack Vector

An authenticated user sends a crafted HTTP request to the withdrawal review endpoint with action=approve. The server processes the request without verifying whether the caller holds the required approval role. The attack is fully remote and requires no social engineering.

python

# Security patch excerpt - backend-web/app/api/routes/distribution.py
# The fix returns explicit permission failure messages from the service layer
"""更新对接记录"""
_, is_admin = resolve_owner_scope(current_user)
update_data = data.model_dump(exclude_unset=True)
success, message = await service.update_dock_record(
    record_id, current_user.id, is_admin=is_admin, **update_data
)
if not success:
    return ApiResponse(success=False, message=message)
return ApiResponse(success=True, message="更新成功")

Source: GitHub commit 19fc3282a1bb78a05c34945c088525d20e081cbd

Detection Methods for CVE-2026-15753

Indicators of Compromise

Unexpected HTTP requests to /api/v1/payment/withdraw/review?action=approve from low-privilege user sessions.
Withdrawal approval events in application logs that lack a corresponding administrator session.
Requests to the review endpoint using HTTP verbs that differ from the documented API contract.

Detection Strategies

Instrument the payment API to log the authenticated user role alongside each action parameter value and alert on mismatches.
Correlate authentication logs with withdrawal state transitions to identify approvals that bypass the normal reviewer workflow.
Deploy web application firewall rules that enforce method allowlists on the withdrawal review endpoint.

Monitoring Recommendations

Track the volume of action=approve requests per user account and baseline normal reviewer behavior.
Monitor commit adoption across deployments to confirm the fix in 19fc3282a1bb78a05c34945c088525d20e081cbd is present.
Review VulDB and the project issue tracker for updated exploitation details.

How to Mitigate CVE-2026-15753

Immediate Actions Required

Update xianyu-auto-reply to the revision containing commit 19fc3282a1bb78a05c34945c088525d20e081cbd.
Audit historical withdrawal approvals for entries created by non-reviewer accounts.
Rotate API tokens for any accounts observed interacting with the affected endpoint.

Patch Information

The upstream maintainer published the fix in commit 19fc3282a1bb78a05c34945c088525d20e081cbd. The patch removes unused authentication schemas and tightens permission scoping in backend-web/app/api/routes/auth.py and backend-web/app/api/routes/distribution.py. Administrators should pull the latest branch from the project repository and redeploy.

Workarounds

Restrict access to /api/v1/payment/withdraw/review through a reverse proxy allowlist that enforces reviewer identity.
Block non-standard HTTP methods at the ingress layer for the payment API path.
Require multi-party approval for withdrawals through an out-of-band workflow until patching completes.

bash

# Nginx configuration example - restrict methods and require an admin header
location /api/v1/payment/withdraw/review {
    limit_except POST {
        deny all;
    }
    if ($http_x_reviewer_role != "admin") {
        return 403;
    }
    proxy_pass http://backend_upstream;
}