fuint: Missing authentication in order detail API exposes member data
Summary
fuint through commit 4c4bc8a contains a missing authentication flaw in the /clientApi/order/detail endpoint. An unauthenticated attacker can enumerate sequential order IDs and retrieve buyer names, national ID numbers, phone numbers, addresses, WeChat openIds and verification codes. The attack requires only network access to the application and no user interaction.
Affected
- fuint through commit 4c4bc8a68e0a93d37c37ab374f72d64728c9e5f8
- Affected code per CVE references: WebConfig.java (lines 80-101) and ClientOrderController.java (lines 77-80)
- Note: CVSS scores differ between sources (8.7 CVSS 4.0 in the CVE record, 7.5 CVSS 3.1 at Strix, 5.3 at VulDB)
Fixed in
Unknown.
Workaround
- Require authentication for /clientApi/order/** at a reverse proxy, API gateway or WAF
- Restrict the API surface to trusted networks or VPN where the mini-program does not need public access
- Review the interceptor configuration in WebConfig.java against the endpoint and verify after any change
Exploitation
- No evidence of in-the-wild exploitation found.
- A third-party write-up on HackMD is listed in the CVE record; its content could not be verified.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Check whether any fuint instance is in use and whether it is reachable from the internet.
- If exposed, apply the gateway restriction above immediately.
- Check the upstream repository for a fix and re-assess after any new commit.
- Review access logs for enumeration of order-detail requests.
- If exposure is possible, involve the data protection contact, as personal data may be affected under the Swiss FADP.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-110128 WebConfig.java at commit 4c4bc8a github.com
- CVE-2026-110128 ClientOrderController.java at commit 4c4bc8a github.com
- VulnCheck advisory: fuint missing authentication via clientApi order detail www.vulncheck.com
- Third-party write-up: fuint order detail unauthenticated IDOR hackmd.io
- OSV: CVE-2026-110128 osv.dev
- VulDB entry 417825 vuldb.com
- Strix: CVE-2026-110128 www.strix.ai
- fuint project repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:25.
Original description (NVD)
fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the /clientApi/order/detail endpoint. Attackers can enumerate sequential orderId values without an Access-Token to expose buyer names, national ID numbers, phone numbers, addresses, WeChat openIds and verification codes.
NVD references (4)
- https://github.com/fushengqian/fuint/blob/4c4bc8a68e0a93d37c37ab374f72d64728c9e5f8/fuint-application/src/main…
- https://github.com/fushengqian/fuint/blob/4c4bc8a68e0a93d37c37ab374f72d64728c9e5f8/fuint-application/src/main…
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/fuint-order-detail-unauthenticated-idor
- https://www.vulncheck.com/advisories/fuint-through-commit-4c4bc8a-missing-authentication-via-clientapi-order-…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.