CVE-2026-110128

The fuint software (specifically through commit 4c4bc8a ) contains a missing authentication vulnerability in the /clientApi/order/detail endpoint. This flaw allows unauthenticated attackers to perform an IDOR attack by enumerating sequential orderId values without an Access-Token . Successful exp...

CVE-2026-110128 fuint through commit 4c4bc8a Missing Authentication via /clientApi/order/detail

fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the /clientApi/order/detail endpoint. Attackers can enumerate sequential orderId values without an Access-Token to expose buyer names,...