CVE-2026-110129 Details

A vulnerability allowing unauthorized access to other members' refund records has been identified in the fuintCatering application, specifically in the ClientRefundController's refund detail endpoint. This insecure direct object reference (IDOR) vulnerability enables authenticated users to read the refund records of others by manipulating the refundId parameter. The issue arises because the endpoint lacks proper authorization checks, allowing attackers to exploit the vulnerability by registering for an account and sequentially enumerating refund IDs. As a result, they can access sensitive personal information, including names, national ID numbers, addresses, WeChat open IDs, and order details.

To address this vulnerability, the owner check should be added to the 'detail' method of the ClientRefundController. This check should compare the refund's owner to the authenticated member and reject any mismatches. Additionally, the service layer should be updated to enforce ownership by adding a userId predicate to the refund lookup, preventing future unauthorized access. A regression test should also be implemented to ensure that members cannot read each other's refund details.