# CVE-2026-110129: fuintCatering insecure direct object reference in refund endpoint

Source: https://junglewise.ai/threats/cve-2026-110129-fuintcatering-through-commit-122c9e6-contains-an-insecure-direct  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-110129 · Severity: medium · CVSS 6.5 · Published 2026-10-13

fuintCatering is a catering and membership management system with a refund processing feature. An insecure design in the refund detail endpoint allows authenticated users to view other members' refund records by guessing sequential refund IDs, exposing sensitive personal data including names, national IDs, addresses, and order information.

Technologies: [Fushengqian fuintCatering](https://junglewise.ai/threats/technologies/fuintcatering). Vendors: [Fushengqian](https://junglewise.ai/threats/vendors/fushengqian).

## Quick answers

**Is CVE-2026-110129 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110129 being exploited in the wild.

**How severe is CVE-2026-110129?** Medium severity, with a CVSS score of 6.5, published 13 October 2026.

**Which products and versions are affected?** Fushengqian fuintCatering through commit 122c9e6.

**Is there a fix for CVE-2026-110129?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-110129 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-110129?** Check whether you run Fushengqian fuintCatering at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The ClientRefundController's refund detail endpoint performs insufficient authorization checks, allowing authenticated members to enumerate refundId parameters and retrieve refund records belonging to other users. The vulnerability stems from missing object-level access control in the refund retrieval logic. An attacker with a valid account can sequentially iterate through refundId values to harvest other buyers' personal information, order details, and payment records.

## Affected products

- fushengqian fuintCatering through commit 122c9e6

## Timeline

- 2026-10-13: disclosed

## References

- [https://github.com/fushengqian/fuintCatering/blob/122c9e61a1bc7d947428b7c4f8be4faa76f38e11/fuintBackend/fuint-application/src/main/java/com/fuint/common/service/impl/RefundServiceImpl.java](https://github.com/fushengqian/fuintCatering/blob/122c9e61a1bc7d947428b7c4f8be4faa76f38e11/fuintBackend/fuint-application/src/main/java/com/fuint/common/service/impl/RefundServiceImpl.java)
- [https://github.com/fushengqian/fuintCatering/blob/122c9e61a1bc7d947428b7c4f8be4faa76f38e11/fuintBackend/fuint-application/src/main/java/com/fuint/module/clientApi/controller/ClientRefundController.java](https://github.com/fushengqian/fuintCatering/blob/122c9e61a1bc7d947428b7c4f8be4faa76f38e11/fuintBackend/fuint-application/src/main/java/com/fuint/module/clientApi/controller/ClientRefundController.java)

## Related threats

- [fushengqian fuintCatering improper access control in commission cash function](https://junglewise.ai/threats/cve-2026-124569-a-vulnerability-was-found-in-fushengqian-fuintcatering-up-to)
- [fushengqian fuintCatering improper access control in RefundServiceImpl](https://junglewise.ai/threats/cve-2026-124568-a-vulnerability-has-been-found-in-fushengqian-fuintcatering-up)