CVE-2026-111354
crmeb_java through 3.1 Authorization Bypass via Front Order Express and Refund Endpoints
crmeb crmeb_java
CVSS
2.3LowExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 16 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 16% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Attackers can request /api/front/order/express/{orderId} or /api/front/order/apply/refund/{orderId} to view victims' tracking numbers, logistics traces, payment amounts and product lines.
Text from CVE List
Affected versions 1
- crmeb_javaaffected: all versions through 3.1CVE List
References 5
- vulncheck.com/advisories/crmeb-java-through-3.1-authorization-bypass-via-front-order-express-and-refund-endpointsAdvisoryvia CVE List
- hackmd.io/@hieuPenguinnn/crmeb-java-order-express-refund-cross-member-idorExploitvia CVE List
- github.com/crmeb/crmeb_java/blob/31bb30dd240dc1168c7eeef065edf36b9700022e/backend/crmeb-service/src/main/java/com/zbkj/service/service/impl/OrderServiceImpl.java#L766-L771Referencevia CVE List
- github.com/crmeb/crmeb_java/blob/31bb30dd240dc1168c7eeef065edf36b9700022e/backend/crmeb-service/src/main/java/com/zbkj/service/service/impl/OrderServiceImpl.java#L832-L836Referencevia CVE List
- github.com/crmeb/crmeb_java/blob/31bb30dd240dc1168c7eeef065edf36b9700022e/backend/crmeb-service/src/main/java/com/zbkj/service/service/impl/OrderServiceImpl.java#L2100-L2109Referencevia CVE List