Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.3
CVE-2026-111705: fushengqian/fuint lets logged‑in users view others' bookings
CVE-2026-111705 · published 19 days ago
Summary
The fuint system lets a signed‑in member request any booking record by changing the bookId number in the URL. By doing so they can see personal details of other members, such as names, phone numbers and verification codes. Update to the latest version of fuint or apply the vendor’s patch to stop arbitrary bookId access.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| fushengqian | fuint | <= 57ec01895e22dd93f16f493db30a77a7c1b148f2 |
Original advisory text
Fuint through commit 57ec018 IDOR via bookId in myBookDetail
Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other members' booking records by supplying arbitrary bookId values to /clientApi/book/myBookDetail. Attackers can iterate the auto-increment bookId to retrieve contact names, mobile numbers, in-store verification codes, service dates, stores and remarks.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-1117... Vendor Advisory
- https://github.com/fushengqian/fuint Product
- https://github.com/fushengqian/fuint/blob/57ec01895e22dd93f16f493db30a77a7c1b148... Third Party Advisory
- https://github.com/fushengqian/fuint/blob/57ec01895e22dd93f16f493db30a77a7c1b148... Third Party Advisory
- https://hackmd.io/@hieuPenguinnn/fuint-booking-detail-idor Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-111705 Vendor Advisory
- https://www.vulncheck.com/advisories/fuint-through-commit-57ec018-idor-via-booki... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.3
High
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published16 Oct 2026
Updated4 Nov 2026
First seen16 Oct 2026
Track software like this
Free during beta