Live › vulnerability › CVE-2026-111705
Go to dashboardFuint, a membership and booking system, lets any logged-in member fetch another member's booking by changing the bookId value in the myBookDetail API. An attacker can iterate sequential IDs to collect names, mobile numbers, in-store verification codes and service details.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run Fuint through commit 57ec018 with member accounts open to users outside the operator's staff. The flaw is in the booking detail endpoint, so any deployment exposing that endpoint to logged-in members is exposed. Deployments without member self-service or on a later revision are not affected by this entry.
No product ranges from the sources yet.
57ec018, for example by checking the deployed repository revision./clientApi/book/myBookDetail returns a booking that belongs to a different account when given another member's bookId (only on a test instance you control).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other members' booking records by supplying arbitrary bookId values to /clientApi/book/myBookDetail. Attackers can iterate the auto-increment bookId to retrieve contact names, mobile numbers, in-store verification codes, service dates, stores and remarks.
This page as .md · .json · in your agent: get_signal("CVE-2026-111705")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.