{"id":"CVE-2026-111359","summary":"CRMEB 5.6.1 through 6.0.0 IDOR via giftDetail and receiveGift","details":"CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift to redirect paid goods to their address.","modified":"2026-10-20T11:16:54.289808833Z","published":"2026-10-15T21:43:47.038Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111359.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-639"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111359.json"},{"type":"ADVISORY","url":"https://hackmd.io/@hieuPenguinnn/crmeb-gift-order-idor-takeover"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111359"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/crmeb-5.6.1-through-6.0.0-idor-via-giftdetail-and-receivegift"},{"type":"PACKAGE","url":"https://github.com/crmeb/CRMEB"},{"type":"ARTICLE","url":"https://github.com/crmeb/CRMEB/blob/v6.0.0/crmeb/app/services/order/StoreOrderServices.php#L2998-L3085"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/crmeb/crmeb","events":[{"introduced":"22ba274dd2583edf28270292ea7bb0f4934e933c"},{"last_affected":"e9d6c4675dc86501c21cdb9ee83e8b62e4b25afc"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"5.6.1"},{"last_affected":"6.0.0"},{"range":[{"introduced":"5.6.1"},{"last_affected":"6.0.0"}],"source":"DESCRIPTION"}]}}],"versions":["v6.0.0","v5.6.3.1","v5.6.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111359.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N"}]}