CVE-2026-111359

High · CVSS 7.1

Published 2026-10-15

CVSS

7.1

High

EPSS

—

exploit probability

Active Exploit

not yet listed

High — patch soon — High severity. Target patch within 7 days.

What is CVE-2026-111359?

CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift to redirect paid goods to their address.

CVSS Score Explained

CVSS 7.1 is High severity. Exploitation is likely straightforward and the impact is significant — data loss, privilege escalation, or remote code execution are common outcomes. Patch as soon as possible.

EPSS Exploitation Probability

No EPSS score yet — model needs more data on this CVE.

References & Patches

Track vulnerabilities for your stack

Tell us what tech you run — Node.js, Python, Java, nginx, whatever — and get a weekly email when new CVEs affect it.

Set up my stack watchlist What is a CVE?

Recent CVEs

Browse all CVEs →CISA KEV list →My watchlist →