CVE-2026-111354
Low · CVSS 2.3Published 2026-10-15
CVSS
2.3
Low
EPSS
—
exploit probability
Active Exploit
No
not yet listed
Low — routine — Low severity. Handle in normal patch cycle.
What is CVE-2026-111354?
crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Attackers can request /api/front/order/express/{orderId} or /api/front/order/apply/refund/{orderId} to view victims' tracking numbers, logistics traces, payment amounts and product lines.
Likely affects:Node.jsJava / SpringRuby / Rails
CVSS Score Explained
CVSS 2.3 is Low severity. Impact is limited and exploitation is difficult. Patch when convenient.
EPSS Exploitation Probability
No EPSS score yet — model needs more data on this CVE.
References & Patches
- ›https://github.com/crmeb/crmeb_java/blob/31bb30dd240dc1168c7eeef065edf36b9700022e/backend/crmeb-service/src/main/java/com/zbkj/service/service/impl/OrderServiceImpl.java#L2100-L2109
- ›https://github.com/crmeb/crmeb_java/blob/31bb30dd240dc1168c7eeef065edf36b9700022e/backend/crmeb-service/src/main/java/com/zbkj/service/service/impl/OrderServiceImpl.java#L766-L771
- ›https://github.com/crmeb/crmeb_java/blob/31bb30dd240dc1168c7eeef065edf36b9700022e/backend/crmeb-service/src/main/java/com/zbkj/service/service/impl/OrderServiceImpl.java#L832-L836
- ›https://hackmd.io/@hieuPenguinnn/crmeb-java-order-express-refund-cross-member-idor
- ›https://www.vulncheck.com/advisories/crmeb-java-through-3.1-authorization-bypass-via-front-order-express-and-refund-endpoints
Track vulnerabilities for your stack
Tell us what tech you run — Node.js, Python, Java, nginx, whatever — and get a weekly email when new CVEs affect it.
Recent CVEs
- CVE-2026-8311Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-5819Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-2937Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-107316Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-107172Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2025-3778Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—