CVE-2026-110129
fuintCatering through commit 122c9e6 IDOR via /clientApi/refund/detail
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenticated members read other members' refund records. Attackers can register freely and enumerate sequential refundId values to obtain buyers' names, national ID numbers, addresses, WeChat openIds, and order details.
| CWE | CWE-639 |
| Vendor | fushengqian |
| Product | fuintcatering |
| Published | Oct 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for fushengqian fuintcatering
Be the first to know when new medium vulnerabilities affecting fushengqian fuintcatering are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
fushengqian / fuintCatering
0 ≤ 122c9e61a1bc7d947428b7c4f8be4faa76f38e11
References
hackmd.io: https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/fuintcatering-client-refund-detail-idor github.com: https://github.com/fushengqian/fuintCatering/blob/122c9e61a1bc7d947428b7c4f8be4faa76f38e11/fuintBackend/fuint-application/src/main/java/com/fuint/module/clientApi/controller/ClientRefundController.java#L123-L133 github.com: https://github.com/fushengqian/fuintCatering/blob/122c9e61a1bc7d947428b7c4f8be4faa76f38e11/fuintBackend/fuint-application/src/main/java/com/fuint/common/service/impl/RefundServiceImpl.java#L330-L353 vulncheck.com: https://www.vulncheck.com/advisories/fuintcatering-through-commit-122c9e6-idor-via-clientapi-refund-detail
Credits
hieuPenguinnn