The vulnerability is an insecure direct object reference (IDOR) in the fuintCatering ClientRefundController refund detail endpoint. It permits an authenticated user to read refund records belonging to other members by supplying arbitrary refundId values. The exposed data include buyers' names, national ID numbers, addresses, WeChat openIds, and order details, leading to significant confidentiality loss. This weakness corresponds to CWE-639, where access checks are insufficient before use of an externally supplied identifier.

The affected product is fushengqian's fuintCatering application. No specific version information is available in the current data, so all deployments of this application may be vulnerable until a patch is released.

The CVSS score of 7.1 indicates a high severity issue. EPSS information is not provided, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this flaw by simply registering, logging in, and iterating sequential refundId values through the /clientApi/refund/detail endpoint, an application-level vector over standard network channels. The lack of constraints on the refundId parameter makes enumeration trivial, and an attacker can harvest sensitive personal data from the application.