Missing Authentication Vulnerability in fuint Product by Fushengqian

CVE-2026-110128

What is CVE-2026-110128?

The fuint product contains a vulnerability that allows unauthorized attackers to access sensitive order details through the /clientApi/order/detail endpoint. This vulnerability stems from missing authentication, enabling attacker to enumerate order IDs and retrieve personal information such as buyer names, national IDs, phone numbers, addresses, and verification codes without requiring an access token.

References