CVE-2026-111359
7.1HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-639
Impact
Authenticated storefront users can steal other customers' paid orders and view their identities. An attacker only needs a low-privileged store account to enumerate order IDs and reroute shipments to their own address.
Root cause
The gift-order API endpoints (gift_detail and receive_gift) fail to verify that the requesting user owns the order ID before exposing the gift key and processing order claims.
Affected systems
CRMEB 5.6.1 through 6.0.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Fix & remediation
Upgrade to a release after 6.0.0 once published. In the interim, block access to the gift_detail and receive_gift API endpoints at your reverse proxy or WAF.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift to redirect paid goods to their address.