TI-2026-82217 CVE-2026-118691 · GHSA-8xg3-rxxw-rm99
Missing authorization in xianyu-auto-reply-fix allows message sending
Priority MEDIUM 61
xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users' accounts using publicly known…