A parameter tampering flaw in the /ticket/customer endpoint of Omega Solution:CoinEx Crypto 2025 allows an attacker to manipulate the status, page, and count arguments and trigger an unintended disclosure of customer data. The vulnerability is related to insecure information disclosure (CWE-200) and an authorization bypass flaw (CWE-284). By exploiting this weakness, an adversary can obtain sensitive customer details that should be protected, potentially violating confidentiality and granting a foothold for further attacks.

The affected system is Omega Solution:CoinEx Crypto version 2025. The product’s website is no longer available, and it is uncertain whether the product has been retired or replaced. No additional version details are provided by the CNA, so all installations of the 2025 release are considered vulnerable.

The CVSS score of 5.3 indicates a moderate severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, and the exploit code has already been released to the public, which raises the practical risk of exploitation. Organizations running the affected version should consider the potential for data exposure and any downstream impacts on customers.