CVE-2026-111354 in Java
Summary
by MITRE • 10/16/2026
crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Attackers can request /api/front/order/express/{orderId} or /api/front/order/apply/refund/{orderId} to view victims' tracking numbers, logistics traces, payment amounts and product lines.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in crmeb_java versions up to 3.1 represents a critical failure in server-side access control mechanisms, specifically classified under CWE-284 Improper Access Control. This flaw allows authenticated users to bypass authorization checks when accessing sensitive order-related endpoints. The core technical issue lies in the application's inability to validate whether the requesting user is the legitimate owner of the specific order resource being accessed. Instead of binding the request context strictly to the session or token identity associated with a particular customer account, the system relies solely on the orderId parameter provided by the client. This design oversight creates an Insecure Direct Object Reference (IDOR) scenario where sequential or predictable identifiers can be iterated through to enumerate and access data belonging to other users.
From an operational perspective, this vulnerability enables authenticated members to read private information associated with other customers' orders without any additional authentication steps beyond the initial login. By manipulating the orderId parameter in API calls such as /api/front/order/express/{orderId} or /api/front/order/apply/refund/{orderId}, attackers can retrieve sensitive data including tracking numbers, detailed logistics traces, payment amounts, and specific product lines. This exposure violates fundamental privacy principles and compromises the confidentiality of customer data. The impact extends beyond simple information disclosure; it facilitates potential social engineering attacks where an attacker uses legitimate order details to impersonate a victim or conduct targeted fraud. Furthermore, access to refund endpoints could potentially be leveraged in conjunction with other vulnerabilities to disrupt business operations or manipulate financial records if additional logic flaws exist within the refund processing workflow.
This vulnerability aligns closely with MITRE ATT&CK technique T1078 Valid Accounts, as it requires initial authentication but then exploits weak authorization controls to access unauthorized resources. It also reflects CWE-639 Authorization Bypass Through User-Controlled Key, where the key used for authorization decisions is directly controlled by the user and not properly validated against server-side session data or ownership records. The lack of proper object-level permission checks means that any authenticated user can traverse through order IDs to harvest personal identifiable information (PII) and financial details from multiple victims in a systematic manner.
To mitigate this vulnerability, developers must implement strict authorization checks on all endpoints handling sensitive resources. This involves verifying that the orderId requested by the client corresponds exactly to an order record owned by the authenticated user associated with the current session or token. The application should query the database to confirm ownership before returning any data or allowing actions such as refund applications. Additionally, implementing rate limiting and monitoring for unusual patterns of ID enumeration can help detect and block automated attacks exploiting this flaw. Upgrading to a patched version that enforces these access controls is essential for restoring security integrity.