Vulnerability · Published Oct 15, 2026 · Assigned by VulnCheck
CVE-2026-111359CRMEB 5.6.1 through 6.0.0 IDOR via giftDetail and receiveGift
High 7.1
In plain English
A high-severity authorization bypass via user-controlled key in CRMEB from crmeb. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.3%top 83.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift to redirect paid goods to their address.
Affected products (as reported)
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
References
- https://hackmd.io/@hieuPenguinnn/crmeb-gift-order-idor-takeover third-party-advisory
- https://github.com/crmeb/CRMEB/blob/v6.0.0/crmeb/app/services/order/StoreOrderServices.php#L2998-L3085 technical-description
- https://github.com/crmeb/CRMEB product
- VulnCheck Advisory: CRMEB 5.6.1 through 6.0.0 IDOR via giftDetail and receiveGift third-party-advisory