{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/crmeb-5.6.1---6.0.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:crmeb:crmeb:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-111359"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CRMEB (5.6.1 - 6.0.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["CRMEB"],"content_html":"\u003cp\u003eCRMEB versions 5.6.1 through 6.0.0 are affected by an Insecure Direct Object Reference (IDOR) vulnerability within the gift-order API. This flaw stems from the application failing to properly validate user authorization when accessing order-related endpoints. An authenticated storefront user can exploit this to perform unauthorized actions on other customers' orders. By enumerating sequential order identifiers, an attacker can harvest sensitive buyer information and gift keys, eventually allowing them to intercept and redirect paid goods to an arbitrary address. This vulnerability poses a significant risk to the integrity of commerce transactions and customer data privacy within affected CRMEB deployments.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthorized access to sensitive buyer identities and the redirection of paid purchases. This results in direct financial loss to users and significant reputational damage to merchants using the affected CRMEB versions.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply the vendor-provided patch for CRMEB to address CVE-2026-111359.\u003c/li\u003e\n\u003cli\u003eMonitor web application access logs for anomalous, high-frequency GET requests to gift_detail endpoints that exhibit sequential ID patterns.\u003c/li\u003e\n\u003cli\u003eImplement strict authorization checks on all gift-order API endpoints to ensure users can only access objects associated with their own session or account UID.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T22:50:32Z","date_published":"2026-10-15T22:50:32Z","id":"https://feed.craftedsignal.io/briefs/2026-10-crmeb-idor/","summary":"CRMEB versions 5.6.1 through 6.0.0 contain an IDOR vulnerability allowing authenticated attackers to enumerate and hijack order details via the gift-order API.","title":"Insecure Direct Object Reference in CRMEB gift-order API","url":"https://feed.craftedsignal.io/briefs/2026-10-crmeb-idor/"}],"language":"en","title":"CraftedSignal Threat Feed - CRMEB (5.6.1 - 6.0.0)","version":"https://jsonfeed.org/version/1.1"}