{"id":"CVE-2026-111705","kind":"vulnerability","aliases":["CVE-2026-111705"],"related":[],"title":"Fuint: members can read other members' booking records by ID","description":"Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other members' booking records by supplying arbitrary bookId values to /clientApi/book/myBookDetail. Attackers can iterate the auto-increment bookId to retrieve contact names, mobile numbers, in-store verification codes, service dates, stores and remarks.","summary":"Fuint, a membership and booking system, lets any logged-in member fetch another member's booking by changing the bookId value in the myBookDetail API. An attacker can iterate sequential IDs to collect names, mobile numbers, in-store verification codes and service details.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fuint","member-portal","package","self-hosted"],"not_affected_if":["later-revision","no-member-accounts"],"how_to_check":"- Confirm whether the deployment runs Fuint at or before commit `57ec018`, for example by checking the deployed repository revision.\n- Test whether `/clientApi/book/myBookDetail` returns a booking that belongs to a different account when given another member's bookId (only on a test instance you control).","fix":"- unknown","status":"open","published_at":"2026-10-16T18:17:54+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:27:01+00:00","updated_at":"2026-10-25T04:27:01+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:27:01Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"Fuint: members can read other members' booking records by ID","impact":"medium","summary":"Fuint, a membership and booking system, lets any logged-in member fetch another member's booking by changing the bookId value in the myBookDetail API. An attacker can iterate sequential IDs to collect names, mobile numbers, in-store verification codes and service details.","category":"package","nicknames":[],"who_cares":["fuint","self-hosted","member-portal"],"confidence":0.6,"needs_auth":"yes","worst_case":"Other members' names, phone numbers and verification codes readable","analyst_note":"Find the fixed revision or release after commit 57ec018 in the Fuint repository and confirm the myBookDetail ownership check was added.","how_to_check":"- Confirm whether the deployment runs Fuint at or before commit `57ec018`, for example by checking the deployed repository revision.\n- Test whether `/clientApi/book/myBookDetail` returns a booking that belongs to a different account when given another member's bookId (only on a test instance you control).","needs_analyst":true,"not_affected_if":["no-member-accounts","later-revision"],"who_is_affected":"Teams that run Fuint through commit 57ec018 with member accounts open to users outside the operator's staff. The flaw is in the booking detail endpoint, so any deployment exposing that endpoint to logged-in members is exposed. Deployments without member self-service or on a later revision are not affected by this entry.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00061,"input_tokens":3343,"output_tokens":551,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111705':13A,16A '-2026':12A,15A '/clientapi/book/mybookdetail':97C '57ec018':73C 'allow':82C 'anoth':38B 'api':50B 'arbitrari':93C 'attack':52B,98C 'authent':83C 'auto':103C 'auto-incr':102C 'book':7A,29B,41B,89C 'bookid':45B,94C,105C 'chang':43B 'code':66B,116C 'collect':58B 'commit':72C 'contact':108C 'contain':74C 'cve':11A,14A 'date':118C 'detail':69B 'direct':77C 'fetch':37B 'fuint':1A,17B,25B,70C 'host':24B 'id':10A,56B 'in-stor':62B,112C 'increment':104C 'insecur':76C 'iter':54B,100C 'let':31B 'log':34B 'logged-in':33B 'member':2A,6A,19B,36B,39B,84C,88C 'member-port':18B 'membership':27B 'mobil':60B,110C 'mybookdetail':49B 'name':59B,109C 'number':61B,111C 'object':78C 'packag':21B 'portal':20B 'read':4A,86C 'record':8A,90C 'refer':79C 'remark':121C 'retriev':107C 'self':23B 'self-host':22B 'sequenti':55B 'servic':68B,117C 'store':64B,114C,119C 'suppli':92C 'system':30B 'valu':46B,95C 'verif':65B,115C 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Fuint through commit 57ec018 with member accounts open to users outside the operator's staff. The flaw is in the booking detail endpoint, so any deployment exposing that endpoint to logged-in members is exposed. Deployments without member self-service or on a later revision are not affected by this entry.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111705","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111705","severity":null,"published_at":"2026-10-16T18:17:54+00:00","modified_at":"2026-10-19T14:17:00+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}