CVE-2026-111359 crmeb CVE debrief

Who should care

Defenders responsible for CRMEB installations, particularly those with storefront functionality, should assess their exposure and prioritize remediation. This vulnerability can be exploited by authenticated users, which may lead to unauthorized access to sensitive order information.

Why it matters

CVE-2026-111359 is a high-severity IDOR vulnerability in CRMEB that allows authenticated users to read and claim other users' orders. Defenders should prioritize verifying and remediating this vulnerability to prevent potential unauthorized access to sensitive order information and maintain customer trust.

• Potential unauthorized access to sensitive order information
• Possible redirection of paid goods to unintended addresses
• Need for verification of CRMEB version and remediation
• Potential impact on customer trust and order integrity

Technical summary

The vulnerability is caused by an insecure direct object reference (IDOR) in the gift-order API of CRMEB, which allows authenticated storefront users to read and claim other users' orders. This is achieved by enumerating sequential order IDs in the gift_detail API to harvest buyer identities and the gift_key, and then calling receive_gift to redirect paid goods to their address. The vulnerability can be exploited by authenticated users, which may lead to unauthorized access to sensitive order information. Defenders should prioritize verifying and remediating this vulnerability in their CRMEB installations, as it can be exploited by authenticated users to gain unauthorized access to sensitive order information.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their CRMEB installations, as it can be exploited by authenticated users to gain unauthorized access to sensitive order information.

Recommended defensive actions

• Verify CRMEB version and check if it is within the affected range (5.6.1 through 6.0.0)
• Review and restrict access to the gift-order API
• Implement proper authorization and validation for gift order operations
• Monitor for suspicious activity related to gift orders
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the exact versions affected and the remediation steps are not explicitly stated in the provided sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.