CVE-2026-111354

Received Received - Intake

Authorization Bypass in crmeb_java Exposes Member Orders

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Attackers can request /api/front/order/express/{orderId} or /api/front/order/apply/refund/{orderId} to view victims' tracking numbers, logistics traces, payment amounts and product lines.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111354

Affected Vendors & Products

Vendor	Product	Version / Range
crmeb	crmeb_java	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an authorization bypass in crmeb_java through version 3.1. It allows authenticated users to access other users' order details by providing their order numbers. Attackers can exploit endpoints like /api/front/order/express/{orderId} or /api/front/order/apply/refund/{orderId} to view sensitive information such as tracking numbers, logistics traces, payment amounts, and product lines.

Detection Guidance

Check for unauthorized access to order details via endpoints like /api/front/order/express/{orderId} or /api/front/order/apply/refund/{orderId}. Monitor logs for repeated requests to these paths with varying order IDs.

Impact Analysis

If you use crmeb_java, attackers could access your order details, including payment information and product lines, by guessing or obtaining order numbers. This could lead to privacy breaches, financial loss, or misuse of personal data.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA by exposing personal and financial data without authorization. GDPR requires protecting personal data, and HIPAA mandates safeguarding health-related payment information. Non-compliance could result in legal penalties.

Mitigation Strategies

Restrict access to the vulnerable endpoints by implementing proper authentication and authorization checks. Update crmeb_java to a patched version if available. Review and audit order data access logs for suspicious activity.

Hi! I’m here to help you understand CVE-2026-111354. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70