CRMEB CVE-2026-111359

Requires a valid low-privilege authenticated storefront account on the CRMEB instance (PR:L), which is typically obtainable via open customer self-registration. The deployment must use the gift-order feature so that gift_detail/receive_gift endpoints are reachable and target orders carry a gift_key. Exploitation depends on sequential/predictable order IDs being enumerable and on the targeted gift orders being unclaimed (receive_gift not yet consumed). No victim interaction, no admin access, and no non-default configuration are needed beyond the gift-order functionality being active.

CVSS 4.0 base score is 7.1 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N and VC:L/VI:H/VA:N, meaning remote, low-complexity exploitation that requires only a low-privilege authenticated account and no user interaction. The high integrity impact (VI:H) reflects the core harm - an attacker reassigns and claims other users' paid goods - while confidentiality is rated low (VC:L) because buyer identities are exposed but not bulk-sensitive credentials. The limiting factor is PR:L: the attacker needs a storefront user account, but on a public e-commerce platform self-registration is typically open, so this is a weak barrier. No CISA KEV listing is present (not confirmed actively exploited), no EPSS score was provided in the input (exploitation probability cannot be quantified from this data), and no POC flag was set - though reference [cveorg] hackmd.io is a detailed technical writeup describing the enumeration and receive_gift takeover method, which materially lowers the effort to develop a working exploit. SSVC decision data was not provided. Net: a genuine, financially-motivated order-theft priority for any live CRMEB deployment using gift orders, but real-world blast radius is constrained by the product's limited global footprint rather than by exploit difficulty.

An attacker registers an ordinary storefront account on a CRMEB shop, then iterates sequential order IDs against the gift_detail endpoint to read other buyers' order details and extract each order's gift_key. Using that key, the attacker calls receive_gift to reassign the already-paid goods to their own shipping address, stealing merchandise without any elevated privilege or victim interaction. A public technical writeup (hackmd.io) documents the full method, though no packaged/weaponized exploit tool is confirmed in the input.