CVE-2026-110128 in fuint
Summary
by MITRE • 10/13/2026
fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the /clientApi/order/detail endpoint. Attackers can enumerate sequential orderId values without an Access-Token to expose buyer names, national ID numbers, phone numbers, addresses, WeChat openIds and verification codes.
If you want to get best quality of vulnerability data, you may have to visit VulDB.