CVE-2026-110128Published
fuint through commit 4c4bc8a Missing Authentication via /clientApi/order/detail
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-110128 · Microsoft / collected KEV context
cve-program · CVE-2026-110128
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/fuint-order-detail-unauthenticated-idor
- https://github.com/fushengqian/fuint/blob/4c4bc8a68e0a93d37c37ab374f72d64728c9e5f8/fuint-application/src/main/java/com/fuint/module/clientApi/controller/ClientOrderController.java#L77-L80
- https://github.com/fushengqian/fuint/blob/4c4bc8a68e0a93d37c37ab374f72d64728c9e5f8/fuint-application/src/main/java/com/fuint/common/config/WebConfig.java#L80-L101
- https://www.vulncheck.com/advisories/fuint-through-commit-4c4bc8a-missing-authentication-via-clientapi-order-detail
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.