Is CVE-2026-111705 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111705?

CVE-2026-111705 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-111705

Description

Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other members' booking records by supplying arbitrary bookId values to /clientApi/book/myBookDetail. Attackers can iterate the auto-increment bookId to retrieve contact names, mobile numbers, in-store verification codes, service dates, stores and remarks.