Description
CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift to redirect paid goods to their address.
Published: 2026-10-15
Score: 7.1 High
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
Description CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift to redirect paid goods to their address.
Title CRMEB 5.6.1 through 6.0.0 IDOR via giftDetail and receiveGift
First Time appeared Crmeb
Crmeb crmeb
Weaknesses CWE-639
CPEs cpe:2.3:a:crmeb:crmeb:*:*:*:*:*:*:*:*
Vendors & Products Crmeb
Crmeb crmeb
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Crmeb Crmeb
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-15T21:43:47.038Z

Reserved: 2026-10-15T20:57:06.851Z

Link: CVE-2026-111359

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-15T22:19:33.937

Modified: 2026-10-15T22:19:34.060

Link: CVE-2026-111359

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses