CVE-2026-111705 fushengqian CVE debrief

Who should care

Defenders responsible for Fuint deployments, security teams, and vulnerability management teams should assess their exposure and prioritize verification and mitigation of this vulnerability. They should review the official advisory, assess the affected scope, and apply patches or mitigations as available. Additionally, they should verify the presence of Fuint commit 57ec018 in their deployment and implement input validation for the bookId parameter.

Why it matters

CVE-2026-111705 is a medium-severity vulnerability in Fuint that allows authenticated attackers to access sensitive booking records. Defenders should prioritize verification and mitigation to prevent potential data exposure.

• Authenticated attackers can access sensitive booking records
• Potential for unauthorized data exposure
• Requires verification of Fuint version and patching
• May impact confidentiality of customer data

Technical summary

The vulnerability exists in the Fuint application, specifically in the ClientBookController.java and BookItemServiceImpl.java files. An attacker can exploit this vulnerability by supplying arbitrary bookId values to the /client/Api/book/myBookDetail endpoint, allowing them to read other members' booking records. This issue was publicly disclosed on October 16, 2026, and last modified on October 19, 2026. The vulnerability allows authenticated members to read other members' booking records by manipulating the bookId parameter.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their Fuint deployments and apply patches or mitigations as available.

Recommended defensive actions

• Verify the presence of Fuint commit 57ec018 in your deployment
• Restrict access to the /client/Api/book/myBookDetail endpoint
• Implement input validation for the bookId parameter
• Monitor for unauthorized access to booking records
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to additional information. The vulnerability exists in Fuint through commit 57ec018. To verify and mitigate this vulnerability, defenders should review the official advisory, assess their exposure, and prioritize patching or applying mitigations. Evidence limits suggest that the vulnerability allows authenticated members to read other members' booking records by supplying arbitrary bookId values to /client/

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.