CVE-2026-111705: Fuint through commit 57ec018 IDOR via bookId in myBookDetail
Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other members' booking records by supplying arbitrary bookId values to /clientApi/book/myBookDetail. Attackers can iterate the auto-increment bookId to retrieve contact names, mobile numbers, in-store verification codes, service dates, stores and remarks.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated member account is required. The attacker can then request the booking-detail endpoint with arbitrary bookId values.
What information could be exposed?
Other members' booking records may disclose contact names, mobile numbers, in-store verification codes, service dates, stores, and remarks.
How can an organization determine whether it is affected?
Review access to /clientApi/book/myBookDetail and test whether a member can retrieve another member's booking by changing the bookId parameter. Sequential or otherwise arbitrary bookId values returning records for different members indicate exposure.