CVE-2026-111354: Authorization Bypass Through User-Controlled Key in crmeb crmeb_java

CVE-2026-111354 describes an authorization bypass vulnerability in crmeb_java through version 3.1. Authenticated members can exploit this flaw by supplying arbitrary order numbers to the endpoints /api/front/order/express/{orderId} and /api/front/order/apply/refund/{orderId}, enabling them to read other members' order information including tracking numbers, logistics traces, payment amounts, and product lines. The vulnerability does not allow unauthenticated access and has a high attack complexity, resulting in a low severity rating.

The vulnerability allows authenticated users to view sensitive order information of other users, potentially leading to privacy violations and information disclosure. However, the impact is limited by the requirement for authentication and the high complexity of exploitation. There is no indication of further privilege escalation or remote code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoints to authorized users only and monitor for suspicious activity involving order ID manipulation.