Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "UPDATE Ant Group",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jiqiang Feng via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "[This is an update to communications sent March 12-14 regarding Alipay security vulnerabilities.]\n\n---\n\nOn March 15, 2026, four WeChat articles documenting security vulnerabilities in Alipay were forcibly deleted from the \npublic account AI-security-innora. The deletion was carried out by Tencent at the request of Beijing Geyun Law Firm, \nacting on behalf of Ant Group, citing China\u0027s Cybersecurity Law.\n\nThe same complaint had been rejected by WeChat four days earlier on grounds of \"reputation infringement\" -- at that \npoint WeChat found it did not meet the threshold for removal. When resubmitted under a different legal theory, the \narticles were deleted without further review.\n\n---\n\nWHAT WAS DELETED\n\n1. \"Whitelist bypass as a universal attack key\" (\u5f53\u767d\u540d\u5355\u7ed5\u8fc7\u6ca6\u4e3a\u5168\u7f51\u653b\u51fb\u7684\u94a5\u5319)\n2. \"The gag order rejected by WeChat, then reversed\" (\u5de8\u5934\u7684\u5c01\u53e3\u4ee4\u88ab\u5fae\u4fe1\u9a73\u56de)\n3. \"GPS location silently exfiltrated from 1B+ users\u0027 payment app\" (\u4f4d\u7f6e\u88ab\u79d2\u5077)\n4. \"Security research vs. a cease-and-desist for an article with zero mentions of Alipay\"\n\n---\n\nTHE BROADER DISCLOSURE RECORD\n\nThe underlying research covers 17 vulnerabilities (CVSS 7.4-9.3) in Alipay for iOS/Android, reported to Ant Group \nthrough responsible disclosure. Ant Group\u0027s formal response: \"normal functionality.\"\n\nIndependent verification and institutional acceptance:\n- MITRE: 6 CVEs accepted, Ticket #2005801\n- Packet Storm: Advisory #217089 published\n- CSSF Luxembourg: Whistleblowing case CSSFWB-2026-080\n- HKMA Hong Kong: Case CE20260313175412\n- PDPC Singapore: Investigation #00629724\n- Apple Product Security: Case OE01052449093014\n- Google Play: Policy violation review #9-7515000040640\n- CIRCL Luxembourg: Case #4782984 (relayed to Alibaba SRC)\n- 38+ institutions across 22 jurisdictions have acknowledged the report\n\nFull technical report: https://innora.ai/zfb/\nGitHub: https://github.com/sgInnora/alipay-deeplink-research\n\n---\n\nTHE CENSORSHIP PATTERN\n\nThis escalation follows a documented sequence:\n\n1. Oral denial by vendor (\"normal functionality,\" March 10)\n2. Public blog published after disclosure window elapsed (March 11)\n3. Cease-and-desist via Beijing Geyun Law Firm (March 11, 4h29m after publication)\n4. Initial WeChat complaint REJECTED (reputation infringement standard not met)\n5. Re-filed under Cybersecurity Law -- all 4 articles deleted without further notice (March 15)\n6. Server-side blocking of PoC demonstration traffic (documented separately)\n\nThis pattern is consistent with suppression of security research rather than legitimate legal remedy. disclose.io \nmaintains a researcher threats database at https://threats.disclose.io/ that tracks this category of legal and \nplatform-based retaliation against good-faith researchers.\n\nA full bilingual analysis of this censorship event is available at: https://innora.ai/zfb/\n\n---\n\nI am available for verification, additional documentation, or technical questions.\n\nJiqiang Feng\nInnora AI Security Research\nfeng () innora ai\nhttps://innora.ai/zfb/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T08:13:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/7"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Mar/7"
        },
        {
          "url": "https://github.com/sgInnora/alipay-deeplink-research"
        },
        {
          "url": "https://innora.ai/zfb/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://threats.disclose.io/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Mar/7"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "UPDATE: Ant Group Censors 4 Security Research Articles After Initial Complaint Rejection",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0242",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/7",
            "automated": true,
            "contentSha256": "f12bb476b564c255d13e198a5fb0e7a28d725ccca29027603773149a484a6d65",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/7",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-03-15T12:18:43Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:41Z",
    "dateUpdated": "2026-09-08T08:13:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0242"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}