CVE-2026-110128 Details

A missing authentication vulnerability has been identified in the Fuint application, specifically in the client API order detail endpoint. This vulnerability allows unauthenticated attackers to access the order details of any member by exploiting the lack of authentication and authorization checks. The issue arises from an interceptor exclusion that bypasses token validation, coupled with a controller method that fails to verify order ownership. As a result, attackers can sequentially enumerate order IDs and retrieve sensitive personal information, including buyer names, national ID numbers, phone numbers, addresses, WeChat open IDs, and verification codes.

Remove the '/clientApi/order/detail' and '/clientApi/order/list' paths from the interceptor exclusion list in 'WebConfig', and implement an ownership check in the 'ClientOrderController.detail' method to ensure that members can only access their own orders.