CRMEB versions 5.6.1 through 6.0.0 contain an insecure direct object reference that can be exploited by authenticated storefront users. By calling the gift_detail API endpoint, an attacker can enumerate sequential order identifiers, capturing buyer identities and the associated gift_key. Subsequent requests to receive_gift can redirect the fulfillment of these paid orders to the attacker’s own address, thereby granting unauthorized access to order contents and enabling theft of goods. The weakness is identified as CWE-639, an authorization bypass through a user‑controlled key.

All installations of the CRMEB platform from release 5.6.1 up to and including 6.0.0 are affected. The vulnerability is triggered when the gift-detail and receive-gift API endpoints are invoked in these releases, regardless of the environment or deployment configuration.

With a CVSS score of 7.1 the issue is classified as high severity. The EPSS score is not available, making the exact exploitation probability uncertain, but the required condition—an authenticated storefront account—is readily satisfied by any regular user. Although the vulnerability is not yet listed in the CISA KEV catalogue, the combination of authentication, lack of proper access control, and the ability to redirect goods poses a serious risk of confidential data exposure and loss of purchase integrity.