CVE-2026-110128
Received Received - Intake

Missing Authentication in Fuint Exposes Order Data

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the /clientApi/order/detail endpoint. Attackers can enumerate sequential orderId values without an Access-Token to expose buyer names, national ID numbers, phone numbers, addresses, WeChat openIds and verification codes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-110128
EUVD
EUVD-2026-98893

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fushengqian fuint 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authentication flaw in fuint through commit 4c4bc8a. It allows unauthenticated attackers to access sensitive order details via the /clientApi/order/detail endpoint by guessing sequential order IDs. Exposed data includes buyer names, national ID numbers, phone numbers, addresses, WeChat openIds and verification codes.

Detection Guidance

Check for unauthorized access to the /clientApi/order/detail endpoint by monitoring HTTP requests to this path. Look for sequential orderId values being queried without an Access-Token header. Use tools like curl to test if the endpoint leaks order details without authentication.

Impact Analysis

Unauthenticated attackers can retrieve your personal and financial information by exploiting this flaw. This includes your name, national ID, phone number, address, and WeChat details. Attackers can also access verification codes, which may lead to identity theft or unauthorized account access.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and potential failure to implement proper security measures. It may also breach HIPAA if protected health information is exposed through order details. Organizations could face fines and legal consequences for non-compliance.

Mitigation Strategies

Immediately restrict access to the /clientApi/order/detail endpoint by implementing authentication checks. Require a valid Access-Token for all requests to this endpoint. Update the application to enforce strict access controls and validate user permissions before returning order details.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110128. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart