High severity · published Oct 15, 2026
CVE-2026-111359
CRMEB 5.6.1 through 6.0.0 IDOR via giftDetail and receiveGift
7.1
CVSS
0.3%
EPSS
No
On KEV
Description
CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift to redirect paid goods to their address.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CR
CRMEB · crmeb
5.6.1 through 6.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111359
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111359
github.com
https://github.com/crmeb/CRMEB
github.com
https://github.com/crmeb/CRMEB/blob/v6.0.0/crmeb/app/services/order/StoreOrderServices.php#L2998-L3085
hackmd.io
https://hackmd.io/@hieuPenguinnn/crmeb-gift-order-idor-takeover
www.vulncheck.com
https://www.vulncheck.com/advisories/crmeb-5.6.1-through-6.0.0-idor-via-giftdetail-and-receivegift
More from CRMEB
9.8
CVE-2026-1202
CRMEB LoginController.php appleLogin improper authentication
9.8
CVE-2025-25763
crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system/SystemDatabackupServices.php
9.8
CVE-2023-3234
Zhong Bang CRMEB PublicController.php put_image deserialization
9.8
CVE-2023-3232
Zhong Bang CRMEB Image Upload app_auth deserialization
9.8
CVE-2023-30185
CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \attachment\SystemAttachmentServices.php