CVE-2026-110129
Received Received - Intake

Insecure Direct Object Reference in fuintCatering Exposes Member Refund Data

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenticated members read other members' refund records. Attackers can register freely and enumerate sequential refundId values to obtain buyers' names, national ID numbers, addresses, WeChat openIds, and order details.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-110129
EUVD
EUVD-2026-98894

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fushengqian fuintCatering 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an insecure direct object reference in the ClientRefundController refund detail endpoint of fuintCatering. It allows authenticated members to read other members' refund records by exploiting sequential refundId values. Attackers can register freely and enumerate these IDs to obtain sensitive data like buyers' names, national ID numbers, addresses, WeChat openIds, and order details.

Detection Guidance

Check for sequential refundId values in the ClientRefundController refund detail endpoint. Monitor for unauthorized access to refund records by authenticated members. Look for unusual enumeration patterns in refund data requests.

Impact Analysis

If you are a user of fuintCatering, attackers could access your personal and financial data, including your name, national ID number, address, WeChat ID, and order details. This could lead to identity theft, fraud, or other malicious activities using your information.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and potential failure to protect user information. It may also breach HIPAA if refund records contain protected health information. Organizations using this software could face legal penalties, fines, and reputational damage for non-compliance.

Mitigation Strategies

Implement proper authorization checks in the ClientRefundController to ensure users can only access their own refund records. Disable sequential refundId enumeration by using non-sequential or random identifiers. Apply input validation to prevent direct object reference attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110129. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart