fuintCatering EUVD-2026-98894

Requires a valid authenticated member account against the ClientRefundController refund detail endpoint; the description states registration is open, so this authentication barrier is low but still mandatory (PR:L, not unauthenticated). Exploitation depends on refundId values being sequential and guessable and on refund records existing to enumerate. Limiting factors: the attacker must register and authenticate, impact is confined to reading refund/PII data (no write or system impact), and the product must be deployed at or near the vulnerable commit (122c9e6). No user interaction or non-default configuration is required.

This is a credible but moderate-priority data-exposure issue rather than a critical remote-code-execution threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows network-reachable, low-complexity exploitation requiring only low-privilege authentication, with a single high impact on confidentiality (VC:H) and no integrity or availability impact. The practical risk is amplified by the fact that the required privilege is trivially obtained: the description states attackers can register freely, so PR:L is effectively a near-zero barrier, and the sequential/enumerable refundId makes mass harvesting straightforward. No EPSS score, no CISA KEV listing, and no confirmed public exploit code were provided in the input, so there is no evidence of active exploitation - this is not confirmed in-the-wild activity. However, the referenced VulnCheck advisory and hackmd write-up publicly document the trivial enumeration technique, which lowers the skill barrier. Net assessment: a real authorization/PII-leakage priority for anyone running fuintCatering (especially given exposure of national ID numbers), but its real-world blast radius is constrained by the product's niche footprint rather than by exploitation difficulty.

An attacker self-registers a free member account, authenticates to the client API, and calls the ClientRefundController refund detail endpoint while incrementing the refundId parameter. Because the endpoint performs no ownership check and IDs are sequential, the attacker iterates through all refund records to harvest other members' names, national ID numbers, addresses, WeChat openIds, and order details. The enumeration technique is publicly documented in the VulnCheck advisory and hackmd write-up, though no packaged exploit code was identified in the input.