CVE-2026-111705 Details

An insecure direct object reference (IDOR) vulnerability has been identified in Fuint, specifically in the booking detail API endpoint '/clientApi/book/myBookDetail', prior to the commit 57ec018. This vulnerability allows authenticated users to access other users' booking information by manipulating the 'bookId' parameter. The exposed data includes contact names, phone numbers, verification codes, service dates, store details, and additional remarks. The issue arises because the API does not properly validate ownership of the booking records before disclosing sensitive information.

The vulnerability can be addressed by adding an ownership verification step in the 'myBookDetail' API handler. This should involve checking that the 'bookId' belongs to the authenticated user before returning any booking details. Additionally, the booking retrieval method should be updated to include this ownership check, ensuring that only authorized users can access their own booking information.