CVE-2026-110128: fuint through commit 4c4bc8a Missing Authentication via /clientApi/order/detail
fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the /clientApi/order/detail endpoint. Attackers can enumerate sequential orderId values without an Access-Token to expose buyer names, national ID numbers, phone numbers, addresses, WeChat openIds and verification codes.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker who can reach the /clientApi/order/detail endpoint can exploit it. No Access-Token or prior account access is required.
What information can be exposed?
An attacker can retrieve order details containing buyer names, national ID numbers, phone numbers, addresses, WeChat openIds, and verification codes.
How would an attacker obtain other customers' records?
The affected endpoint accepts orderId values that can be enumerated sequentially. An attacker can iterate through those values to retrieve other members' order details.
How can I determine whether my deployment is exposed?
Check whether the deployment includes the cited commit 4c4bc8a and whether /clientApi/order/detail returns order data when requested without an Access-Token. A response containing order details for an arbitrary orderId indicates exposure.