CVE-2026-111705 Fuint through commit 57ec018 IDOR via bookId in myBookDetail

Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other members' booking records by supplying arbitrary bookId values to /clientApi/book/myBookDetail. Attackers can iterate the auto-increment bookId to retrieve contac...

CVE-2026-111705

The Fuint application (specifically in commit 57ec018) is vulnerable to an Insecure Direct Object Reference (IDOR) in the /clientApi/book/myBookDetail endpoint. This vulnerability allows authenticated members to access the booking records of other members by providing arbitrary bookId values. By ...