{"id":"CVE-2026-110128","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-110128","summary":"fuint through commit 4c4bc8a Missing Authentication via /clientApi/order/detail","details":"fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the /clientApi/order/detail endpoint. Attackers can enumerate sequential orderId values without an Access-Token to expose buyer names, national ID numbers, phone numbers, addresses, WeChat openIds and verification codes.","published":"2026-10-13T16:53:21.745Z","modified":"2026-10-14T02:48:20.160114667Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110128.json"},{"type":"PACKAGE","url":"https://github.com/fushengqian/fuint"},{"type":"ARTICLE","url":"https://github.com/fushengqian/fuint/blob/4c4bc8a68e0a93d37c37ab374f72d64728c9e5f8/fuint-application/src/main/java/com/fuint/common/config/WebConfig.java#L80-L101"},{"type":"ARTICLE","url":"https://github.com/fushengqian/fuint/blob/4c4bc8a68e0a93d37c37ab374f72d64728c9e5f8/fuint-application/src/main/java/com/fuint/module/clientApi/controller/ClientOrderController.java#L77-L80"},{"type":"ADVISORY","url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/fuint-order-detail-unauthenticated-idor"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110128"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/fuint-through-commit-4c4bc8a-missing-authentication-via-clientapi-order-detail"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-14T02:48:20.160114667Z"}}