Medium severity · published Oct 16, 2026
CVE-2026-111705
Fuint through commit 57ec018 IDOR via bookId in myBookDetail
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other members' booking records by supplying arbitrary bookId values to /clientApi/book/myBookDetail. Attackers can iterate the auto-increment bookId to retrieve contact names, mobile numbers, in-store verification codes, service dates, stores and remarks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FU
fuint · fushengqian
through 57ec01895e22dd93f16f493db30a77a7c1b148f2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111705
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111705
github.com
https://github.com/fushengqian/fuint/blob/57ec01895e22dd93f16f493db30a77a7c1b148f2/fuint-application/src/main/java/com/fuint/common/service/impl/BookItemServiceImpl.java#L237-L258
github.com
https://github.com/fushengqian/fuint/blob/57ec01895e22dd93f16f493db30a77a7c1b148f2/fuint-application/src/main/java/com/fuint/module/clientApi/controller/ClientBookController.java#L252-L265
hackmd.io
https://hackmd.io/@hieuPenguinnn/fuint-booking-detail-idor
www.vulncheck.com
https://www.vulncheck.com/advisories/fuint-through-commit-57ec018-idor-via-bookid-in-mybookdetail
More from fuint
7.5
CVE-2026-110128
fuint through commit 4c4bc8a Missing Authentication via /clientApi/order/detail
3.1
CVE-2025-12623
fushengqian fuint Authentication Token ClientSignController.java authorization