CVE-2026-111354: crmeb_java through 3.1 Authorization Bypass via Front Order Express and Refund Endpoints
crmebjava through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Attackers can request /api/front/order/express/{orderId} or /api/front/order/apply/refund/{orderId} to view victims' tracking numbers, logistics traces, payment amounts and product lines.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated member account can exploit it. The attacker needs a target order number and can then query the affected order express or refund endpoints.
Is user interaction or elevated privilege required?
No user interaction or elevated administrative privilege is required. Exploitation requires only a low-privileged authenticated member account.
What information could be exposed?
An attacker can read other members' tracking numbers, logistics traces, payment amounts, and product line details.
How can I determine whether my deployment is affected?
Deployments of crmeb_java through version 3.1 should be considered affected. Test with two separate member accounts and attempt to access one account's order through /api/front/order/express/{orderId} or /api/front/order/apply/refund/{orderId} using the other account's authenticated session.