crmeb_java through version 3.1 contains an authorization bypass that lets an authenticated member supply any order identifier and obtain detailed order data. The affected endpoints expose tracking numbers, logistics traces, payment amounts and product lines, effectively leaking sensitive information belonging to other members. The flaw corresponds to Authentication and Authorization Failures, mapped by CWE-639.

The vulnerability affects the crmeb Java e‑commerce platform (crmeb_java) up to and including version 3.1. Users running 3.1 or any earlier release are susceptible. No other product versions are listed as affected.

The CVSS score of 2.3 indicates a low severity overall, but the requirement for an authenticated user means that any compromised or legitimate account can exploit it. Attackers can trigger the flaw by calling the public /api/front/order/express/{orderId} or /api/front/order/apply/refund/{orderId} endpoints. The EPSS score of 0.00257 (<1%) indicates a very low probability of exploitation, and the flaw is not listed in CISA’s KEV catalog, suggesting limited known exploitation. Nonetheless, the confidential disclosure of order details remains a valid threat for organizations using this software.