Fuint CVE-2026-111705

Requires a valid authenticated Fuint member account to reach the /clientApi/book/myBookDetail endpoint (PR:L), after which no further special configuration is needed - the endpoint accepts an attacker-supplied bookId and performs no ownership/authorization check. Exploitation is reliable because bookId is an auto-increment integer, enabling sequential enumeration of all booking records. The only meaningful limiting factor is that the attacker must first obtain member-level authentication; there is no requirement for user interaction, admin privileges, or a non-default configuration, and the affected code is the standard booking-detail path present through commit 57ec018.

This is a genuine but moderate-severity authorization flaw, not a top-tier emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N, score 5.3) is internally consistent with the description: a network-reachable, low-complexity IDOR that requires an authenticated member account (PR:L) and leaks limited confidentiality only (VC:L), with no integrity or availability impact. CWE-639 (Authorization Bypass Through User-Controlled Key) matches the described behavior precisely. No EPSS score, no CISA KEV listing, and no SSVC decision data were provided in the input, so exploitation-probability and automatability signals cannot be quantified - their absence should not be read as low risk, only as unmeasured. The one notable conflict is the 'Authentication Bypass' tag, which misdescribes the issue: this is a post-authentication authorization (IDOR) weakness, consistent with PR:L, not an authentication bypass (which would imply PR:N). A detailed public write-up exists (hackmd + VulnCheck advisory) with the exact endpoint and parameter, so a working exploit is effectively available even though no CISA KEV active-exploitation confirmation exists. Net: a real, easily-automatable privacy/PII-disclosure bug worth patching, but its real-world urgency is tempered by the authenticated-access requirement, the low (confidentiality-only) impact, and the product's limited deployment footprint.

An attacker registers or obtains any ordinary member account on a Fuint-based storefront, authenticates to /clientApi, and sends repeated requests to /clientApi/book/myBookDetail while incrementing the auto-increment bookId. Because the endpoint never checks that the booking belongs to the caller, the attacker harvests other members' contact names, mobile numbers, in-store verification codes, service dates, stores, and remarks. The hackmd write-up and VulnCheck advisory document the exact request, making trivial automated enumeration of the entire booking table feasible.