CVE-2026-111354Published

crmeb_java through 3.1 Authorization Bypass via Front Order Express and Refund Endpoints

Explicit identifiers and source references

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-111354 · Microsoft / collected KEV context

cve-program · CVE-2026-111354

https://hackmd.io/@hieuPenguinnn/crmeb-java-order-express-refund-cross-member-idor
https://github.com/crmeb/crmeb_java/blob/31bb30dd240dc1168c7eeef065edf36b9700022e/backend/crmeb-service/src/main/java/com/zbkj/service/service/impl/OrderServiceImpl.java#L766-L771
https://github.com/crmeb/crmeb_java/blob/31bb30dd240dc1168c7eeef065edf36b9700022e/backend/crmeb-service/src/main/java/com/zbkj/service/service/impl/OrderServiceImpl.java#L832-L836
https://github.com/crmeb/crmeb_java/blob/31bb30dd240dc1168c7eeef065edf36b9700022e/backend/crmeb-service/src/main/java/com/zbkj/service/service/impl/OrderServiceImpl.java#L2100-L2109
https://www.vulncheck.com/advisories/crmeb-java-through-3.1-authorization-bypass-via-front-order-express-and-refund-endpoints

Related operational evidence

Explicit CVE identifiers

No related operational record is retained in the current change model.