Quick answers
- Is CVE-2026-105096 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-105096 being exploited in the wild.
- How severe is CVE-2026-105096?
- Medium severity, with a CVSS score of 6.3, published 4 October 2026.
- Which products and versions are affected?
- Omega Solution CoinEx Crypto 2025.
- Is there a fix for CVE-2026-105096?
- No fixed version is recorded yet. Enforce server-side object-level authorization to verify that the authenticated user owns the customer record before allowing modifications. Reject requests to modify resources not belonging to the authenticated user with HTTP 403 Forbidden, and consider deriving the customer identifier from the authenticated session rather than accepting user-supplied IDs.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-105096 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-105096?
- Check whether you run Omega Solution CoinEx Crypto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Enforce server-side object-level authorization to verify that the authenticated user owns the customer record before allowing modifications. Reject requests to modify resources not belonging to the authenticated user with HTTP 403 Forbidden, and consider deriving the customer identifier from the authenticated session rather than accepting user-supplied IDs.</anigation> </invoke>
Technical details
The POST /customer/{id} endpoint (via PUT _method parameter) in CoinEx Crypto 2025 performs insufficient object-level authorization checks, allowing any authenticated user to modify profiles of other users by manipulating the customer ID parameter. The server does not verify that the authenticated user owns the customer record being modified; it only checks whether the user is logged in. A remote, authenticated attacker can change the id parameter to target another customer's profile and successfully update their information.
Affected products
- Omega Solution CoinEx Crypto 2025
Timeline
- 2026-07-17: disclosed: Vulnerability disclosed on GitHub
- 2026-10-04: advisory: Published to NVD