Product
CRMEB versions 5.6.1 through 6.0.0 contain an IDOR vulnerability allowing authenticated attackers to enumerate and hijack order details via the gift-order API.