CVE-2026-111359: CRMEB Auth Bypass Vulnerability

CVE-2026-111359 Overview

CVE-2026-111359 is an Insecure Direct Object Reference (IDOR) vulnerability in CRMEB versions 5.6.1 through 6.0.0. The flaw resides in the gift-order API and allows authenticated storefront users to read and claim other users' orders. Attackers enumerate sequential order IDs through the gift_detail endpoint to harvest buyer identities and the gift_key value. They then invoke receive_gift to redirect paid goods to an attacker-controlled address. The weakness is categorized under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact

Any authenticated storefront account can hijack other users' paid gift orders and reroute merchandise delivery, resulting in financial loss and exposure of buyer personal data.

Affected Products

• CRMEB 5.6.1
• CRMEB versions between 5.6.1 and 6.0.0
• CRMEB 6.0.0

Discovery Timeline

• 2026-10-15 - CVE-2026-111359 published to NVD
• 2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-111359

Vulnerability Analysis

The vulnerability exists in CRMEB's order service, specifically in the gift-order flow implemented in StoreOrderServices.php. The gift_detail API endpoint accepts an order identifier as a user-supplied parameter but does not verify that the requesting account owns the referenced order. The server returns full order metadata, including the recipient-facing gift_key token used to claim the gift.

Once an attacker obtains a valid gift_key, they call the receive_gift endpoint with their own shipping address. The application accepts the claim because possession of the key, not ownership of the order, drives authorization. This conflates authentication with authorization and enables cross-tenant order takeover entirely through the public storefront API.

Root Cause

The root cause is missing object-level authorization on the gift-order service methods. Order IDs are sequential integers, making enumeration trivial. The code path reads the order record and the gift_key without comparing the authenticated user's uid against the order's buyer uid. See the GitHub CRMEB Order Service Code for the vulnerable implementation.

Attack Vector

Exploitation requires only a low-privileged storefront account. The attacker iterates sequential order IDs against the gift_detail endpoint and records any response containing a gift_key. For each harvested key, the attacker submits a receive_gift request with their own address and contact details. The merchant ships the paid goods to the attacker. Detailed exploitation steps are documented in the HackMD IDOR Vulnerability Analysis and the VulnCheck CRMEB Advisory.

No verified proof-of-concept code is published in the referenced advisories.
Review the HackMD analysis and vendor source for request/response structure.

Detection Methods for CVE-2026-111359

Indicators of Compromise

• Repeated sequential requests to the gift_detail endpoint from a single authenticated session or source IP.
• receive_gift calls where the claiming account's uid differs from the original order buyer uid.
• Shipping address changes on gift orders shortly after a gift_detail lookup from a different account.
• Spikes in gift-order status transitions from "paid" to "claimed" without a matching recipient notification trail.

Detection Strategies

• Instrument the storefront API with per-user rate limits on gift_detail and log every denied authorization check.
• Correlate gift_detail and receive_gift events by session, user ID, and target order ID to flag mismatched ownership.
• Hunt web access logs for enumeration patterns, such as monotonically increasing numeric order IDs within short time windows.

Monitoring Recommendations

• Forward CRMEB application and web server logs to a central analytics pipeline for behavior-based querying.
• Alert when a single account accesses more than a defined threshold of distinct order IDs per hour.
• Monitor merchant dashboards for customer complaints about missing gift deliveries, which may indicate successful hijacks.

How to Mitigate CVE-2026-111359

Immediate Actions Required

• Inventory all CRMEB deployments and confirm the installed version falls within the 5.6.1 to 6.0.0 range.
• Restrict access to the gift-order endpoints at the web application firewall until a patch is deployed.
• Audit recent gift_detail and receive_gift activity for unauthorized order claims and reverse any fraudulent fulfillments.
• Rotate gift_key values for all outstanding unclaimed gift orders.

Patch Information

At the time of writing, no fixed version is listed in the referenced advisories. Operators should monitor the GitHub CRMEB Repository for an official release that enforces owner-based authorization in StoreOrderServices.php. Apply the vendor update as soon as it is published and verify through regression testing that cross-account gift_detail requests return an authorization error.

Workarounds

• Add a middleware check that compares the authenticated uid with the order uid before returning gift-order details.
• Replace sequential integer order IDs with unguessable identifiers such as UUIDv4 or signed tokens.
• Require a one-time recipient-side confirmation link, delivered out of band, before receive_gift can finalize an address change.
• Enforce step-up verification on any address modification for gift orders above a monetary threshold.

# Example nginx rule to throttle gift_detail enumeration per authenticated session
limit_req_zone $http_authorization zone=gift_detail:10m rate=10r/m;

location ~* /api/.*/gift_detail {
    limit_req zone=gift_detail burst=5 nodelay;
    proxy_pass http://crmeb_backend;
}