Is CVE-2026-110128 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110128 being exploited in the wild.

How severe is CVE-2026-110128?

High severity, with a CVSS score of 7.5, published 13 October 2026.

Which products and versions are affected?

Fushengqian Fuint through commit 4c4bc8a.

Is there a fix for CVE-2026-110128?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-110128 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-110128?

Check whether you run Fushengqian Fuint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110128: fuint missing authentication in order detail endpoint

CVE-2026-110128 · Severity: high · CVSS 7.5 · Published 2026-10-13

fuint is a membership and e-commerce platform that manages customer orders and loyalty programs. An unauthenticated attacker can access any customer's order details—including personal information like names, national IDs, phone numbers, addresses, and WeChat identifiers—by simply requesting order records without logging in. This allows large-scale harvesting of customer personal and financial data.

Technologies: Fushengqian Fuint. Vendors: Fushengqian.

Quick answers

Is CVE-2026-110128 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110128 being exploited in the wild.
How severe is CVE-2026-110128?: High severity, with a CVSS score of 7.5, published 13 October 2026.
Which products and versions are affected?: Fushengqian Fuint through commit 4c4bc8a.
Is there a fix for CVE-2026-110128?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-110128 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-110128?: Check whether you run Fushengqian Fuint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The /clientApi/order/detail endpoint is excluded from the ClientUserInterceptor's authentication check in WebConfig.java, allowing unauthenticated access. Attackers can enumerate sequential orderId values to retrieve OrderDto objects containing sensitive member information. No authentication token (Access-Token) is required, making this a pre-authentication enumeration attack on sensitive customer records.

Affected products

fushengqian fuint through commit 4c4bc8a

Timeline

2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.