EUVD-2026-98893
GHSA-rqhg-m645-r86c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate exposed fuint /clientApi endpoint
-
ExploitRequest /order/detail with no Access-Token
-
ExecutionEnumerate sequential orderId values
-
ImpactHarvest member PII at scale
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond network reachability - the /clientApi/order/detail endpoint of fuint performs no authentication check, so any attacker who can reach the application over the network can retrieve order details without an Access-Token. Exploitation is amplified because orderId values are sequential and enumerable, enabling bulk extraction. The only real limiting factor is exposure: the fuint instance (or its clientApi) must be reachable by the attacker, which for internal-only deployments reduces the practical threat to insiders or post-perimeter attackers. No authentication, no user interaction, and no non-default configuration are required against a vulnerable build at or before commit 4c4bc8a. |
| Impact | This is a genuine, actionable priority for anyone running fuint, though its real-world blast radius is constrained by the product's small footprint rather than by exploitation difficulty. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes the easiest possible attack profile: network-reachable, low complexity, no privileges, no user interaction, with high confidentiality impact (VC:H) and no integrity or availability impact - consistent with CWE-306 missing authentication combined with sequential, enumerable orderId values (an IDOR). The attack is effectively automatable because orderIds are sequential and no Access-Token is checked, so a single script can bulk-harvest every order record. No EPSS score, no CISA KEV listing, and no explicit POC flag were provided in the input, so there is no quantitative exploitation-probability signal and no confirmation of active exploitation; however, a detailed public technical write-up exists (hackmd advisory) alongside the VulnCheck advisory and direct links to the vulnerable source lines, which materially lowers the bar for an attacker to reproduce it. The signals are consistent rather than conflicting: a high-confidentiality, trivially-exploitable PII disclosure. The main tempering factor is prevalence - fuint is a niche open-source membership/ordering platform, so this is a serious flaw in a low-deployment product rather than an internet-wide emergency. |
| Exploit ScenarioDerived | An unauthenticated attacker discovers an internet-exposed fuint instance and sends GET/POST requests to /clientApi/order/detail with incrementing orderId values and no Access-Token. Because the endpoint is missing authentication, each request returns another member's full order record, letting the attacker script sequential enumeration to mass-harvest buyer names, national ID numbers, phone numbers, addresses, WeChat openIds, and verification codes. No public exploit is identified in the input, but a step-by-step technical write-up describing the flaw is publicly available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Unauthenticated retrieval of complete customer order records from fuint's /clientApi/order/detail endpoint exposes buyer names, national ID numbers, phone numbers, addresses, WeChat openIds and verification codes to any remote attacker who can reach the application, and because orderId values are sequential the entire order table can be enumerated in bulk. The endpoint performs no Access-Token check whatsoever (CWE-306; CVSS 4.0 8.7, assessed CVSS 3.1 7.5 with PR:N, confidentiality-only impact), so no credentials, user interaction, or non-default configuration are required against builds at or before commit 4c4bc8a. No vendor-released patch was identified at time of analysis and no public exploit code was identified; a public technical writeup describing the unauthenticated IDOR is referenced in the advisory links, and practical risk is bounded mainly by how widely the affected fuint instance is exposed rather than by any exploitation difficulty.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation must be applied by the operator. The direct fix is to remove /clientApi/order/detail from the unauthenticated path exclusions in fuint-application/src/main/java/com/fuint/common/config/WebConfig.java (lines 80-101) so the Access-Token interceptor applies, and to add a server-side ownership check in ClientOrderController.java (lines 77-80) that binds the requested orderId to the authenticated member - patching only the interceptor still leaves an IDOR if any other clientApi route resolves orders by caller-supplied ID, and the trade-off is that existing mobile/WeChat clients must be updated to send the token or their order lookups will start returning 401s. If the application cannot be rebuilt, front the clientApi context with a reverse proxy or API gateway that requires authentication for /clientApi/order/* and rejects requests without a token; this stops internet-facing exploitation immediately but will break the legitimate client flow unless the client is updated in parallel. As a containment measure, restrict network reachability of the /clientApi context to trusted networks or a VPN - effective against remote attackers but not against malicious insiders or anyone who already has a foothold on the internal network. Because sequential orderIds make bulk scraping trivial once the endpoint is reachable, add rate limiting and anomaly detection on /clientApi/order/detail as a detection and throttling control, understanding that it only slows leakage rather than preventing it per request, and treat any period of exposure as a data breach: national ID numbers, phone numbers, addresses and WeChat verification codes may already have been harvested, so members should be notified and any verification codes or tokens transmitted through those orders should be considered compromised. Longer term, replace sequential numeric orderIds with unguessable identifiers - this requires schema and API changes and client cooperation but removes the enumeration vector entirely. Source references for the fix are https://github.com/fushengqian/fuint/blob/4c4bc8a68e0a93d37c37ab374f72d64728c9e5f8/fuint-application/src/main/java/com/fuint/common/config/WebConfig.java#L80-L101 and https://github.com/fushengqian/fuint/blob/4c4bc8a68e0a93d37c37ab374f72d64728c9e5f8/fuint-application/src/main/java/com/fuint/module/clientApi/controller/ClientOrderController.java#L77-L80, with the advisory at https://www.vulncheck.com/advisories/fuint-through-commit-4c4bc8a-missing-authentication-via-clientapi-order-detail.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
fuint is a Java/Spring MVC e-commerce (membership and ordering) application, and the flaw lives in its interceptor-based authentication design rather than in a memory-safety or injection class. The WebConfig.java source reference (lines 80-101) shows the Access-Token interceptor registration with excluded path patterns: the /clientApi/** surface is deliberately carved out of the authenticated context, presumably so the mobile/WeChat client can call it with lighter session handling, but /clientApi/order/detail is a sensitive, member-specific resource that was placed behind that exclusion. ClientOrderController.java (lines 77-80) then maps the detail action without any server-side ownership or token check, so the request handler simply looks up the order by the caller-supplied orderId and returns it. This is classic CWE-306 (Missing Authentication for a Critical Function) compounded by an object-reference weakness: sequential numeric orderIds make the missing auth equivalent to a full-table read, because an attacker does not even need to guess non-sequential identifiers. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) and the assessed 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) both describe a pure network-reachable confidentiality breach with no integrity or availability impact, which matches the fact that the endpoint is read-only and returns JSON order data rather than executing state changes. No CPE strings were supplied, so the affected artifact should be treated as the fuint source tree at or below the specified commit rather than a named distribution package.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoint with no authentication (PR:N) or interaction (UI:N) and trivial enumeration (AC:L) yields a pure confidentiality PII disclosure (C:H, I:N, A:N).
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the /clientApi/order/detail endpoint. Attackers can enumerate sequential orderId values without an Access-Token to expose buyer names, national ID numbers, phone numbers, addresses, WeChat openIds and verification codes.
Executive ViewAI
fuint's order management platform is affected by a high-severity vulnerability that allows unauthenticated attackers to retrieve complete customer order records, including sensitive personal data such as national ID numbers and verification codes. This flaw affects all customers whose orders are processed through the platform and could result in large-scale data breaches, regulatory penalties, and reputational harm. No public exploit identified at time of analysis, but a public technical writeup exists, and the risk is amplified by the ease of bulk enumeration of sequential order IDs.
No vendor-released patch identified at time of analysis. Interim mitigations include: enforcing authentication at the API gateway or reverse proxy for the /clientApi/order/detail endpoint, blocking external access to the endpoint via firewall rules, disabling the endpoint if not required, implementing WAF rules to reject requests lacking a valid Access-Token, and monitoring logs for sequential orderId enumeration.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB