Insecure Direct Object Reference in CRMEB gift-order API

CRMEB versions 5.6.1 through 6.0.0 are affected by an Insecure Direct Object Reference (IDOR) vulnerability within the gift-order API. This flaw stems from the application failing to properly validate user authorization when accessing order-related endpoints. An authenticated storefront user can exploit this to perform unauthorized actions on other customers' orders. By enumerating sequential order identifiers, an attacker can harvest sensitive buyer information and gift keys, eventually allowing them to intercept and redirect paid goods to an arbitrary address. This vulnerability poses a significant risk to the integrity of commerce transactions and customer data privacy within affected CRMEB deployments.

Impact

Successful exploitation allows unauthorized access to sensitive buyer identities and the redirection of paid purchases. This results in direct financial loss to users and significant reputational damage to merchants using the affected CRMEB versions.

Recommendation

• Apply the vendor-provided patch for CRMEB to address CVE-2026-111359.
• Monitor web application access logs for anomalous, high-frequency GET requests to gift_detail endpoints that exhibit sequential ID patterns.
• Implement strict authorization checks on all gift-order API endpoints to ensure users can only access objects associated with their own session or account UID.