CVE-2026-111359 is a High severity (CVSS 7.1) insecure direct object reference in CRMEB 5.6.1 through 6.0.0. A logged in shopper can read other users' orders through the gift order API and redirect paid goods. We could not confirm a fixed version.
What's affected
The record says CRMEB 5.6.1 through 6.0.0 is affected. The researcher write-up says it reviewed tag v6.0.0 and confirmed the issue in v5.6.1. We found no fixed release, so check the crmeb/CRMEB repository.
The weakness is CWE-639, authorization bypass through a user-controlled key. Per the write-up, two storefront routes, gift_detail and receive_gift, require a valid user token but do not check order ownership. The handler loads the order by its primary key alone, and that key is a sequential number. Any registered shopper can step through order numbers.
The record says the attacker can read buyer identities and the gift key, and then call receive_gift to send paid goods to their own address. Severity matches across sources: the record gives 7.1 and VulnCheck lists 7.1.
How to check if you're exposed
Check your CRMEB version, from the application's version file or from the tag you deployed.
git describe --tags
Versions 5.6.1 through 6.0.0 are in range per the record. If you run the gift order feature, check your access logs for one account requesting many consecutive order numbers on the gift detail route. That pattern looks like enumeration.
Also check recent gift orders for deliveries redirected to addresses that do not match the buyer's intended recipient. Customer support complaints about missing gifts are another signal. The free in-browser dependency scan at gold.safeguard.sh/scan can match a manifest or lockfile against known CVEs without installing anything.
What to do now
- Check the project for a fixed release and upgrade once you confirm one.
- Add an ownership check to both routes that compares the order's owner with the logged in user, or checks the gift key, before returning data.
- Use random, non-sequential identifiers for orders exposed through APIs.
- Rate limit the gift order routes, and alert on sequential lookups.
- Review recent gift orders, contact affected customers, and refund or reship where goods were redirected.
Why it matters
Sequential identifiers make enumeration trivial, and a missing owner check turns enumeration into a data leak. In a shop, the leak includes buyer identities, and the second route lets the attacker take the goods.
This is a common class in e-commerce platforms, because routes are added for features like gifting and the shared pattern of owner checks is forgotten in the new code. A test that asks one user for another user's order catches it before release. The record does not mark this CVE as known exploited, and none of the pages we read say it is.
Quick check
What is the attack at a high level?
A logged in shopper changes the order number in a gift route to see other buyers' orders, then uses a second route to claim the goods.
Is a fixed version named?
We could not confirm one. Check the project repository.
Sources
Last reviewed: 18 October 2026.
