{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-110128/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:fuint:fuint:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-110128"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["fuint (\u003c= 4c4bc8a)"],"_cs_severities":["high"],"_cs_tags":["web-application-vulnerability","sensitive-data-exposure","cve-2026-110128"],"_cs_type":"advisory","_cs_vendors":["fuint"],"content_html":"\u003cp\u003eThe fuint platform, specifically versions up to commit 4c4bc8a, contains a critical missing authentication vulnerability within its client API. This flaw allows unauthenticated remote attackers to bypass access controls by omitting the required Access-Token header when querying the /clientApi/order/detail endpoint. By systematically enumerating sequential orderId values, an attacker can extract sensitive customer data associated with orders. The exposed information includes personally identifiable information (PII) such as full names, national ID numbers, phone numbers, physical addresses, WeChat openIds, and authentication verification codes. Because the vulnerability relies on predictable, sequential identifiers, the impact is significant, as an attacker can automate the retrieval of records across the entire customer database without requiring prior authorization or specific target knowledge.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability results in a massive unauthorized disclosure of PII for the organization's user base. Successful exploitation leads to the breach of sensitive data, including national IDs and contact details, posing significant legal and regulatory risks. The exposure of WeChat openIds and verification codes further facilitates downstream account takeover or social engineering attacks against the platform's customers.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the immediate audit of all publicly accessible API endpoints within the fuint application to ensure proper authentication middleware enforcement.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the fuint platform to a version released after commit 4c4bc8a that implements mandatory authentication for the /clientApi/order/detail endpoint.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for a high volume of requests to the /clientApi/order/detail endpoint originating from a single IP address with empty or missing authorization tokens.\u003c/li\u003e\n\u003cli\u003eAnalyze access logs for anomalous, sequential orderId patterns, which are indicative of an automated enumeration attack targeting this vulnerability.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T18:38:07Z","date_published":"2026-10-13T18:38:07Z","id":"https://feed.craftedsignal.io/briefs/2026-10-fuint-missing-auth/","summary":"The fuint platform contains a missing authentication vulnerability in the /clientApi/order/detail endpoint, allowing unauthenticated attackers to retrieve sensitive customer order PII via enumeration.","title":"Missing Authentication Vulnerability in fuint API","url":"https://feed.craftedsignal.io/briefs/2026-10-fuint-missing-auth/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-110128","version":"https://jsonfeed.org/version/1.1"}