Insecure direct object reference exposes fuintCatering refund records
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
fuintCatering through commit 122c9e6 has an insecure direct object reference in the ClientRefundController refund detail endpoint (CWE-639). Any authenticated member can read other members' refund records through this endpoint. An attacker can register freely and enumerate sequential refundId values to obtain buyers' names, national ID numbers, addresses, WeChat openIds, and order details.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenticated members read other members' refund records. Attackers can register freely and enumerate sequential refundId values to obtain buyers' names, national ID numbers, addresses, WeChat openIds, and order details.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
No affected products listed by the sources yet.
Remediation
The sources list no fixed version for fuintCatering.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Timeline
- 2026-10-13 Threatist record created from CVE-2026-110129
- 2026-10-13 Alias added: GHSA-5cgx-vmcr-xxc6
- 2026-10-14 Priority changed: MEDIUM → LOW
- 2026-10-15 CISA SSVC decision points changed
- 2026-10-15 Priority changed: LOW → MEDIUM
References
Other 2
- https://github.com/fushengqian/fuintCatering/blob/122c9e61a1bc7d947428b7c4f8be4faa76f38e11/fuintBackend/fuint-application/src/main/java/com/fuint/module/clientApi/controller/ClientRefundController.java#L123-L133
- https://github.com/fushengqian/fuintCatering/blob/122c9e61a1bc7d947428b7c4f8be4faa76f38e11/fuintBackend/fuint-application/src/main/java/com/fuint/common/service/impl/RefundServiceImpl.java#L330-L353
More fushengqian vulnerabilities
- TI-2026-75491 Insecure direct object reference in Fuint exposes member booking records CVSS 4.0MEDIUM 5.3
- TI-2025-11577 fushengqian fuint Authentication Token ClientSignController.java authorization CVSS 4.0LOW 2.3
- TI-2026-72012 Missing authentication in fuint exposes member order details CVSS 4.0HIGH 8.7
Sources
- CVE-2026-110129 · CVE Program
- CVE-2026-110129 · NVD
- FIRST EPSS
- GHSA-5cgx-vmcr-xxc6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences