CVE-2026-111359

Deferred Deferred - Pending Action

CRMEB Gift Order Redirection via Insecure Direct Object Reference

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift to redirect paid goods to their address.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111359

Affected Vendors & Products

Vendor	Product	Version / Range
crmeb	CRMEB	5.6.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CRMEB versions 5.6.1 through 6.0.0 have an insecure direct object reference flaw in the gift-order API. Authenticated storefront users can exploit this to access and claim other users' orders by manipulating sequential order IDs in gift_detail. Attackers can then retrieve buyer identities and gift keys, redirecting purchased items to their own addresses.

Detection Guidance

Check for unauthorized access to gift orders by monitoring API calls to gift_detail and receive_gift endpoints. Look for sequential order ID enumeration attempts or unusual redirection of orders to different addresses.

Impact Analysis

If you use CRMEB in this version range, attackers could steal your orders by guessing order IDs, exposing your personal data and causing financial loss. Your purchased items may be redirected to unauthorized addresses, disrupting legitimate transactions.

Compliance Impact

This vulnerability risks non-compliance with GDPR (data protection) and HIPAA (privacy) due to unauthorized access to personal and sensitive order data. It violates principles of data confidentiality and integrity, potentially leading to legal penalties and reputational damage.

Mitigation Strategies

Upgrade CRMEB to a version beyond 6.0.0 where this vulnerability is fixed. Implement strict access controls to prevent unauthorized API calls and validate user permissions for order-related actions.

Hi! I’m here to help you understand CVE-2026-111359. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70