CoinEx Crypto CVE-2026-105098

Exploitation requires an authenticated low-privilege account (CVSS PR:L) with network access to the application's Support Ticket API, specifically the /ticket/customer endpoint. The attacker manipulates the status, page, or count arguments to trigger the information disclosure; no user interaction or special non-default configuration is indicated. Limiting factors: the requirement for valid (if low-level) credentials narrows the attacker population to users with some existing access, the impact is confined to read-only disclosure of support-ticket information (no write or destructive capability), and the product appears retired with a defunct vendor site, sharply constraining the real-world exploitable population.

This is a low-to-moderate real-world risk that does not warrant emergency prioritization. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a remotely reachable, low-complexity flaw requiring low-level authentication (PR:L), with only low confidentiality impact (VC:L) and no integrity or availability impact - consistent with the CWE-200 information disclosure classification and the base score of 5.3. The E:P (Proof-of-Concept) exploit maturity aligns with the confirmed public PoC on GitHub. However, countervailing signals dominate: this is NOT in CISA KEV (no confirmed active exploitation), no EPSS score was provided to gauge exploitation probability, and the affected product appears retired (vendor website defunct, vendor unresponsive). The combination of a required (if low) privilege, limited impact (read-only information disclosure of support-ticket data), and an apparently abandoned/obscure product means that despite a public exploit, the practical threat surface is small. Exploitation status is 'publicly available exploit code exists' - this must not be conflated with active exploitation, which is not confirmed. Note: all intelligence derives from a single source (VulDB); there is no independent vendor advisory or NVD corroboration, so affected-version precision and impact scope should be treated as unverified.

An attacker holding a low-privilege account on an exposed CoinEx Crypto deployment sends crafted requests to the /ticket/customer endpoint of the Support Ticket API, manipulating the status, page, or count parameters to enumerate and retrieve support-ticket records they should not be able to access. A public proof-of-concept is available on GitHub, lowering the skill barrier, though the low attack complexity and network vector mean exploitation is straightforward for any authenticated user.