{"schema":"threatline.record/2","record":{"id":"CVE-2026-118691","aliases":[],"summary":"xianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via /send-message","details":"xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users' accounts using publicly known default API secrets. Attackers can supply the hard-coded api_key and another user's cookie_id, plus chosen chat_id, to_user_id and message values, to send arbitrary Xianyu messages to buyers from that merchant account.","categories":["Unclassified"],"product":"xianyu-auto-reply-fix","vendor":"GuDong2003","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-118691","source_modified_at":"2026-10-28T21:11:18.629Z","fetched_at":"2026-10-29T00:48:09.584895Z","product":"xianyu-auto-reply-fix","vendor":"GuDong2003","versions":[{"version":"0","lessThanOrEqual":"2.0.7","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":6.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T21:11:18.629Z","modified_at":"2026-10-28T21:11:18.629Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-118691","fetched_at":"2026-10-29T00:48:09.584895Z","source_modified_at":"2026-10-28T21:11:18.629Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/GuDong2003/xianyu-auto-reply-fix/issues/116","tags":["issue-tracking"]},{"source":"CVE List","url":"https://github.com/GuDong2003/xianyu-auto-reply-fix","tags":["product"]},{"source":"CVE List","url":"https://github.com/GuDong2003/xianyu-auto-reply-fix/blob/v2.0.7/reply_server.py#L2347-L2475","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/GuDong2003/xianyu-auto-reply-fix/blob/v2.0.7/db_manager.py#L1011","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/GuDong2003/xianyu-auto-reply-fix/commit/999cfe61c401322d9893eb81ad1a76beabba6cfb","tags":["patch"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/xianyu-auto-reply-fix-through-2.0.7-unauthenticated-message-sending-via-send-message","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T21:11:18.629Z","content_hash":"5a5674359986b7fdbcdc3c6da1aab4899d498d4ac788f3b7620ee4541e06f4cd"}}