Insecure Direct Object Reference in CRMEB Gift Order API
CVE-2026-111359

7.1HIGH

Key Information:

Vendor

Crmeb

Status
Crmeb
Vendor
CVE Published:
15 October 2026

What is CVE-2026-111359?

CRMEB versions 5.6.1 through 6.0.0 have a vulnerability that permits authenticated storefront users to exploit the gift-order API. This vulnerability allows them to access and claim orders belonging to other users by leveraging sequential order IDs in the gift_detail endpoint. Malicious actors can obtain personal data such as buyer identities and gift_keys, enabling them to re-route purchased items to their own addresses via the receive_gift function. This poses a significant risk to customer privacy and data integrity.

Affected Version(s)

CRMEB 5.6.1 <= 6.0.0

References

https://hackmd.io/@hieuPenguinnn/crmeb-gift-order-idor-ta...
third-party-advisory
https://github.com/crmeb/CRMEB/blob/v6.0.0/crmeb/app/serv...
technical-description
https://github.com/crmeb/CRMEB
product

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.