Insecure Direct Object Reference in Fuint Booking System Affects User Data

CVE-2026-111705

What is CVE-2026-111705?

The Fuint Booking System is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability where authenticated users can access other users' booking details. By manipulating the bookId parameter in the /clientApi/book/myBookDetail endpoint, potential attackers may enumerate through the booking IDs, exposing sensitive information such as contact names, mobile numbers, verification codes, service dates, and remarks. This lack of proper authorization checks places user privacy at risk, highlighting the need for robust security measures.

References