CVE-2026-110129
fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in…
- Risk score
- 43/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 13 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenticated members read other members' refund records. Attackers can register freely and enumerate sequential refundId values to obtain buyers' names, nation…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.5 medium
References
- https://github.com/fushengqian/fuintCatering/blob/122c9e61a1bc7d947428b7c4f8be4faa76f38e11/fuintBackend/fuint-application/src/main/java/com/fuint/common/service/impl/RefundServiceImpl.java#L330-L353
- https://github.com/fushengqian/fuintCatering/blob/122c9e61a1bc7d947428b7c4f8be4faa76f38e11/fuintBackend/fuint-application/src/main/java/com/fuint/module/clientApi/controller/ClientRefundController.java#L123-L133
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/fuintcatering-client-refund-detail-idor
- https://www.vulncheck.com/advisories/fuintcatering-through-commit-122c9e6-idor-via-clientapi-refund-detail
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/fuintcatering-client-refund-detail-idor
Original description
fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenticated members read other members' refund records. Attackers can register freely and enumerate sequential refundId values to obtain buyers' names, national ID numbers, addresses, WeChat openIds, and order details.
Last activity 13 Oct 2026. Patch Forecast updates every hour.