Skip to content
CVE-2026-111359: CRMEB Gift Order Vulnerability Exposes User Data

CVE-2026-111359: CRMEB Gift Order Vulnerability Exposes User Data

First seen 17 Oct 2026, 16:47 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 17, 2026 at 18:49 UTC
  • •CVE-2026-111359 affects CRMEB versions 5.6.1 to 6.0.0.
  • •Authenticated users can exploit the gift-order API to access and claim other users' orders.
  • •Mitigation includes upgrading to a vendor-fixed release and monitoring for anomalous activity.

CRMEB versions 5.6.1 to 6.0.0 have a vulnerability (CVE-2026-111359) allowing authenticated users to exploit insecure direct object references in the gift-order API. Attackers can enumerate sequential order IDs to access other users' order details and claim gifts, redirecting goods to their own addresses. This flaw poses significant risks to customer data privacy and transaction integrity. The vulnerability was published on October 15, 2026, with a CVSS score of 7.1, categorized as high severity. Publicly accessible CRMEB storefronts with gift-order features are particularly at risk. Mitigation strategies include upgrading to a fixed release and reviewing access logs for suspicious activity.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-15
CVE-2026-111359 published
CRMEB disclosed a vulnerability allowing unauthorized access to user gift orders via the gift-order API.
Redpacketsecurity
2026-10-16
Vulnerability details confirmed
Hackmd.io provided an in-depth analysis of the CRMEB gift-order vulnerability, detailing the attack vectors and impact.
hackmd.io

More articles in this cluster (2)

Following this threat?

Track CVE-2026-111359 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (2)

1 / 2

Common questions

What versions of CRMEB are affected?
CRMEB versions 5.6.1 through 6.0.0 are affected by this vulnerability.
What is the nature of the vulnerability?
The vulnerability allows authenticated users to access and claim other users' gift orders due to insecure direct object references.
What should organizations do to mitigate this risk?
Organizations should upgrade to the vendor-fixed release and review their access logs for any suspicious activity.