CVE-2026-111705

🗓️ 16 Oct 2026 17:39:57Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 20 Views🌐 WEB

Authenticated IDOR in Fuint via bookId in /clientApi/book/myBookDetail leaks records.

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2026-111705	16 Oct 202618:57	–	circl
CNNVD	Zach Fuint’s authorization issue vulnerabilities	15 Oct 202616:00	–	cnnvd
Cvelist	CVE-2026-111705 Fuint through commit 57ec018 IDOR via bookId in myBookDetail	16 Oct 202617:39	–	cvelist
EUVD	EUVD-2026-102997	16 Oct 202617:39	–	euvd
Mend	CVE-2026-111705	16 Oct 202617:39	–	mend
NVD	CVE-2026-111705	16 Oct 202618:17	–	nvd
Positive Technologies	PT-2026-116104	16 Oct 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-111705: Authorization Bypass Through User-Controlled Key	16 Oct 202600:00	–	rapid7
Vulnrichment	CVE-2026-111705 Fuint through commit 57ec018 IDOR via bookId in myBookDetail	16 Oct 202617:39	–	vulnrichment

[
  {
    "vendor": "fushengqian",
    "product": "fuint",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "0",
        "lessThanOrEqual": "57ec01895e22dd93f16f493db30a77a7c1b148f2",
        "status": "affected",
        "versionType": "git"
      }
    ],
    "packageURL": "pkg:github/fushengqian/fuint",
    "repo": "https://github.com/fushengqian/fuint"
  }
]

Source	Link
github	www.github.com/fushengqian/fuint/blob/57ec01895e22dd93f16f493db30a77a7c1b148f2/fuint-application/src/main/java/com/fuint/common/service/impl/BookItemServiceImpl.java
github	www.github.com/fushengqian/fuint/blob/57ec01895e22dd93f16f493db30a77a7c1b148f2/fuint-application/src/main/java/com/fuint/module/clientApi/controller/ClientBookController.java
vulncheck	www.vulncheck.com/advisories/fuint-through-commit-57ec018-idor-via-bookid-in-mybookdetail
hackmd	www.hackmd.io/@hieuPenguinnn/fuint-booking-detail-idor

Parameter	Position	Path	Description	CWE
bookId	query param	/clientApi/book/myBookDetail	Insecure Direct Object Reference (IDOR) in the book detail endpoint allows authenticated members to access other members' booking records by providing an arbitrary bookId.	CWE-639

19 Oct 2026 14:17Current

6Medium risk

Vulners AI Score6

CVSS 3.14.3

CVSS 45.3

EPSS0.00251

SSVC

CWE-639