Insecure Direct Object Reference in fuintCatering Client Refund Controller

CVE-2026-110129

What is CVE-2026-110129?

The fuintCatering application features a vulnerability in the ClientRefundController that exposes sensitive user information through insecure direct object references. Authenticated users may exploit this flaw to access the refund records of other users by manipulating the refundId values. This could lead to unauthorized disclosure of personally identifiable information (PII) such as names, national ID numbers, addresses, WeChat open IDs, and associated order details. Attackers can exploit this vulnerability simply by registering for the application and sequentially iterating through refund IDs to gain access to sensitive data.

References