A missing authentication check in the /clientApi/order/detail endpoint allows attackers to request any order detail without providing an Access-Token. By iterating sequential orderId values, attackers can repeatedly retrieve sensitive information such as buyer names, national ID numbers, phone numbers, addresses, WeChat openIds, and verification codes. The vulnerability is a directly exploitable access control flaw (CWE-306) and results in a confidentiality compromise of user data.

The flaw affects fuint applications from the fushengqian project that contain the code in commit 4c4bc8a. Any deployment using the fuint application before the removal of the missing authentication check is vulnerable. It is not tied to a specific product version number, but any instance running the vulnerable code path is affected.

The CVSS score is 8.7, indicating a high severity of the flaw. The EPSS score is not available, but the lack of authentication makes the vulnerability relatively easy to exploit via a simple HTTP GET request. The vulnerability is not listed in the CISA KEV catalog. Attackers can enumerate orderIds and gain privileged access without credentials, making this a significant risk to privacy and regulatory compliance.