Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck
CVE-2026-111705Fuint through commit 57ec018 IDOR via bookId in myBookDetail
Medium 4.3
In plain English
A medium-severity authorization bypass via user-controlled key in fuint from fushengqian. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Official description
Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other members' booking records by supplying arbitrary bookId values to /clientApi/book/myBookDetail. Attackers can iterate the auto-increment bookId to retrieve contact names, mobile numbers, in-store verification codes, service dates, stores and remarks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| fushengqian | fuint | 0 – through 57ec01895e22dd93f16f493db30a77a7c1b148f2 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- https://hackmd.io/@hieuPenguinnn/fuint-booking-detail-idor third-party-advisory
- https://github.com/fushengqian/fuint/blob/57ec01895e22dd93f16f493db30a77a7c1b148f2/fuint-application/src/main/java/com/fuint/module/clientApi/controller/ClientBookController.java#L252-L265 technical-description
- https://github.com/fushengqian/fuint/blob/57ec01895e22dd93f16f493db30a77a7c1b148f2/fuint-application/src/main/java/com/fuint/common/service/impl/BookItemServiceImpl.java#L237-L258 technical-description
- VulnCheck Advisory: Fuint through commit 57ec018 IDOR via bookId in myBookDetail third-party-advisory