CVE-2026-111359 in CRMEB
Summary
by MITRE • 10/16/2026
CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift to redirect paid goods to their address.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The identified vulnerability represents a classic insecure direct object reference (IDOR) flaw within the CRMEB e-commerce platform versions 5.6.1 through 6.0.0. This security defect is rooted in the application's failure to properly validate whether an authenticated user has authorization to access or manipulate specific data objects, specifically order records associated with gift transactions. The vulnerability manifests primarily through two distinct API endpoints: one responsible for retrieving detailed information about a gift order and another designed to process the receipt of that gift. Because these endpoints rely on sequential integer identifiers passed directly in request parameters without sufficient server-side authorization checks, an attacker can manipulate these values to interact with resources belonging to other users. This lack of object-level access control allows any authenticated user to bypass intended business logic restrictions and perform actions outside their permitted scope.
The operational impact of this vulnerability is significant as it enables both information disclosure and unauthorized transaction manipulation. By exploiting the gift_detail endpoint, an attacker can enumerate sequential order IDs to harvest sensitive buyer identities and retrieve unique gift keys associated with specific transactions. This enumeration capability transforms a simple IDOR into a broader data harvesting mechanism, allowing attackers to build profiles of legitimate customers or identify high-value targets based on their purchasing history. Furthermore, once sufficient information is gathered, the attacker can leverage the receive_gift endpoint to redirect paid goods intended for another user to an address controlled by the attacker. This results in direct financial loss for both the victims whose orders are hijacked and potentially the merchant if fraud detection mechanisms fail to identify the anomalous delivery patterns or identity mismatches during the shipping process.
From a technical classification perspective, this vulnerability aligns with CWE-284, which describes Improper Access Control, specifically falling under the sub-category of Insecure Direct Object References. The exploitation technique maps directly to MITRE ATT&CK tactic T1078, Valid Accounts, as it requires initial authentication but then abuses those credentials to access unauthorized resources. Additionally, the enumeration aspect relates to CWE-209, which involves the exposure of an error message or behavioral detail that aids in further attacks. The sequential nature of the order IDs facilitates automated scanning and rapid exploitation, reducing the barrier for entry from a skilled attacker to any authenticated user with basic scripting capabilities.
Mitigation strategies must focus on implementing robust authorization checks at both the API level and the business logic layer. Developers should replace direct object references based on predictable identifiers like sequential integers with opaque, non-sequential unique identifiers such as UUIDs or GUIDs that do not reveal information about other records in the database. More critically, every request to sensitive endpoints must include server-side validation ensuring that the authenticated user initiating the request is the legitimate owner of the order ID being accessed or modified. Implementing role-based access control (RBAC) policies and auditing mechanisms can further detect anomalous patterns such as rapid sequential requests from a single IP address. Regular security testing, including automated penetration tests focused on broken object level authorization, should be integrated into the development lifecycle to prevent similar vulnerabilities in future releases of the platform.