CVE-2026-110129: fuintCatering through commit 122c9e6 IDOR via /clientApi/refund/detail
fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenticated members read other members' refund records. Attackers can register freely and enumerate sequential refundId values to obtain buyers' names, national ID numbers, addresses, WeChat openIds, and order details.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require access to a victim's account?
No. The issue can be exploited by an authenticated member account, and the reported conditions state that accounts can be registered freely. No user interaction is required.
What is the expected security impact?
The reported CVSS vector indicates high confidentiality impact only. The issue is described as allowing disclosure of refund and buyer information, with no integrity or availability impact reported.
Which code revision is identified as affected?
The affected revision identified in the report is commit 122c9e61a1bc7d947428b7c4f8be4faa76f38e11. The referenced refund-detail controller and refund service implementation are associated with that revision.