CVE-2026-111359: CRMEB 5.6.1 through 6.0.0 IDOR via giftDetail and receiveGift
CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in giftdetail to harvest buyer identities and the giftkey, then call receivegift to redirect paid goods to their address.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated storefront user can exploit it. No user interaction is required from the affected order owner.
What does an attacker need to do to take over another user's gift order?
The attacker needs to enumerate sequential order IDs through the gift_detail API to obtain buyer identity information and a gift_key, then submit those values to receive_gift with an address they control.
Which versions are affected?
CRMEB versions 5.6.1 through 6.0.0 are identified as affected.
How can I determine whether exploitation may have occurred?
Review gift-order API activity for sequential or unusual gift_detail requests from authenticated storefront accounts, followed by receive_gift calls that redirect paid goods to addresses not associated with the original buyer.