CVE-2026-111705

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-111705

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111705.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-111705

Published

2026-10-16T17:39:57Z

Modified

2026-10-17T02:48:20Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Fuint through commit 57ec018 IDOR via bookId in myBookDetail

Details

Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other members' booking records by supplying arbitrary bookId values to /clientApi/book/myBookDetail. Attackers can iterate the auto-increment bookId to retrieve contact names, mobile numbers, in-store verification codes, service dates, stores and remarks.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111705.json"
}

References

Affected packages

Git / github.com/fushengqian/fuint

Affected ranges

Type: GIT
Repo: https://github.com/fushengqian/fuint
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last Affected

57ec01895e22dd93f16f493db30a77a7c1b148f2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111705.json"