CVE-2026-110128 — fuint through commit 4c4bc8a Missing Authentication via /clientApi/order/detail
fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the /clientApi/orde…
Published: 2026-10-13 · CVSS: 8.7 · CVSS 4.0
fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the /clientApi/order/detail endpoint. Attackers can enumerate sequential orderId values without an Access-Token to expose buyer names, national ID numbers, phone numbers, addresses, WeChat openIds and verification codes.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7