CVE-2026-111354 Details

An authorization bypass vulnerability has been identified in Crmeb Java versions through 3.1. This vulnerability allows authenticated users to access and read order details of other members by manipulating order ID values in the API request. The issue arises in two specific endpoints: '/api/front/order/express/{orderId}' and '/api/front/order/apply/refund/{orderId}'. Exploiting this vulnerability enables attackers to retrieve sensitive information such as tracking numbers, logistics details, payment amounts, and product line items from another member's order.

The vulnerability can be fixed by implementing proper authorization checks to ensure that users can only access their own order information. This can be done by comparing the order owner's ID with the ID of the authenticated user before allowing access to the requested order details.