HIGH 8.7 NVD
CVE-2026-110128
fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via th
fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the /clientApi/order/detail endpoint. Attackers can enumerate sequential orderId values without an Access-Token to expose buyer names, national ID numbers, phone numbers, addresses, WeChat openIds and verification codes.
References
- https://github.com/fushengqian/fuint/blob/4c4bc8a68e0a93d37c37ab374f72d64728c9e5f8/fuint-a
- https://github.com/fushengqian/fuint/blob/4c4bc8a68e0a93d37c37ab374f72d64728c9e5f8/fuint-a
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/fuint-order-detail-unauthenticated-idor
- https://www.vulncheck.com/advisories/fuint-through-commit-4c4bc8a-missing-authentication-v
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-10-13 via NVD.
vulnfeed aggregates 13242 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.