Vulnerability · Published Oct 13, 2026 · Assigned by VulnCheck
CVE-2026-110129fuintCatering through commit 122c9e6 IDOR via /clientApi/refund/detail
Medium 6.5
In plain English
A medium-severity authorization bypass via user-controlled key in fuintCatering from fushengqian. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Official description
fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenticated members read other members' refund records. Attackers can register freely and enumerate sequential refundId values to obtain buyers' names, national ID numbers, addresses, WeChat openIds, and order details.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| fushengqian | fuintCatering | 0 – through 122c9e61a1bc7d947428b7c4f8be4faa76f38e11 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/fuintcatering-client-refund-detail-idor third-party-advisory
- https://github.com/fushengqian/fuintCatering/blob/122c9e61a1bc7d947428b7c4f8be4faa76f38e11/fuintBackend/fuint-application/src/main/java/com/fuint/module/clientApi/controller/ClientRefundController.java#L123-L133 technical-description
- https://github.com/fushengqian/fuintCatering/blob/122c9e61a1bc7d947428b7c4f8be4faa76f38e11/fuintBackend/fuint-application/src/main/java/com/fuint/common/service/impl/RefundServiceImpl.java#L330-L353 technical-description
- VulnCheck Advisory: fuintCatering through commit 122c9e6 IDOR via /clientApi/refund/detail third-party-advisory