CVE-2026-110129 in fuintCatering
Summary
by MITRE • 10/13/2026
fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenticated members read other members' refund records. Attackers can register freely and enumerate sequential refundId values to obtain buyers' names, national ID numbers, addresses, WeChat openIds, and order details.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw represents a classic Insecure Direct Object Reference (IDOR) vulnerability within the fuintCatering application, specifically located in the ClientRefundController refund detail endpoint. This issue stems from a fundamental failure in server-side access control logic where the system relies exclusively on client-supplied input to determine resource ownership without performing adequate authorization checks. By accepting sequential integer values for the refund identifier directly from the user request, the application fails to verify that the authenticated user initiating the request is the legitimate owner of the requested financial record or has administrative privileges to view it. This architectural oversight allows any authenticated member with valid session credentials to bypass intended privacy boundaries and access sensitive data belonging to other users simply by manipulating the primary key parameter in the API call.
The operational impact of this vulnerability is severe due to the high sensitivity of the exposed data fields. Attackers can exploit this flaw through simple enumeration techniques, systematically iterating through sequential refund ID values to harvest a comprehensive dataset of personally identifiable information and financial details. The compromised data includes buyers' full names, national identification numbers which are critical for identity theft in many jurisdictions, physical addresses that pose privacy and safety risks, WeChat openIds linking the vulnerability to social media or messaging platform identities, and detailed order histories. This aggregation of sensitive personal and financial data significantly elevates the risk profile from a simple information disclosure to a potential vector for targeted phishing, identity fraud, and further account takeover attacks against affected users.
From a classification perspective, this vulnerability aligns directly with CWE-639, which defines Insecure Direct Object Reference as an error where a web application uses user-supplied input to access objects such as files, directories, or database records without proper authorization checks. Furthermore, the exploitation technique of enumerating sequential identifiers maps closely to ATT&CK tactic T1078, specifically Valid Accounts and potentially T1592 if used for gathering victim identity information. The ability to register freely exacerbates the risk by lowering the barrier to entry for attackers, allowing them to create multiple accounts or use a single account with automated scripts to scan large volumes of refund records efficiently without triggering typical rate-limiting defenses designed for random access patterns rather than sequential enumeration.
To mitigate this vulnerability, immediate remediation efforts must focus on implementing robust server-side authorization checks within the ClientRefundController endpoint. The application should validate that the authenticated user's identity matches the owner of the requested refund record before returning any data, ensuring that users can only retrieve resources explicitly assigned to them or their associated organization if applicable. Additionally, replacing sequential integer identifiers with unpredictable unique identifiers such as UUIDs would significantly increase the difficulty of enumeration attacks by removing the predictable pattern required for systematic scanning. Complementary security controls should include implementing strict rate limiting on API endpoints to detect and block automated enumeration attempts, along with comprehensive logging and monitoring to alert administrators when unusual access patterns or high volumes of failed authorization checks are detected from specific IP addresses or user accounts.