CVE-2026-111359
CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows…
- Risk score
- 44/100
- CVSS
- 7.1 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 15 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift …
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.1 high
References
- https://github.com/crmeb/CRMEB
- https://github.com/crmeb/CRMEB/blob/v6.0.0/crmeb/app/services/order/StoreOrderServices.php#L2998-L3085
- https://hackmd.io/@hieuPenguinnn/crmeb-gift-order-idor-takeover
- https://www.vulncheck.com/advisories/crmeb-5.6.1-through-6.0.0-idor-via-giftdetail-and-receivegift
- https://hackmd.io/@hieuPenguinnn/crmeb-gift-order-idor-takeover
Original description
CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift to redirect paid goods to their address.
Last activity 15 Oct 2026. Patch Forecast updates every hour.