CVE-2026-111354
LowCVSS 3.1Summary
crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Attackers can request /api/front/order/express/{orderId} or /api/front/order/apply/refund/{orderId} to view victims' tracking numbers, logistics traces, payment amounts and product lines.
Risk Assessment
Breach of confidentiality of other users' order data may lead to leakage of personal and financial information and to abuse.
Recommendation
Upgrade crmeb_java to a version newer than 3.1 once available, and enforce order access authorization based on user identity.
Other vulnerabilities in crmeb_java
See all- CVE-2026-10771High
Server-Side Request Forgery (SSRF) vulnerability in the RestTemplate.getForEntity function in RestTemplateUtil.java in crmeb_java 1.4. An attacker can remotely manipulate the URL argument in the base64 Qrcode endpoint, leading to unauthorized server requests.
- CVE-2024-28714High
SQL Injection vulnerability in CRMEB_Java e-commerce system v.1.3.4 allows an attacker to execute arbitrary code via the groupid parameter.
Original NVD description (English source)
crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Attackers can request /api/front/order/express/{orderId} or /api/front/order/apply/refund/{orderId} to view victims' tracking numbers, logistics traces, payment amounts and product lines.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS