crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Oct 15, 2026 · NIST NVD

   Detected

   crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Attackers can request /api/front/order/express/{orderId} or /api/front/order/apply/refund/{orderId} to view victims' tracking numbers, logistics traces, payment amounts and product lines.

Sources

• CVE.orgVulnerability recordCVE-2026-111354

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-111354

  crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Attackers can request /api/front/order/express/{orderId} or /api/front/order/apply/refund/{orderId} to view vict

  nvd.nist.gov

References

• Reference · github.com
• Reference · github.com
• Reference · github.com
• Reference · hackmd.io
• Reference · vulncheck.com