The vulnerability is an insecure direct object reference that lets authenticated members request data for any booking by supplying an arbitrary bookId in the /clientApi/book/myBookDetail request. The endpoint returns the booking’s contact name, mobile number, in‑store verification code, service dates, store location, and remarks, giving attackers direct access to personally identifiable information that can be used for phishing, fraud, or targeted attacks.

The affected product is fushengqian:fuint v57ec018 (commit 57ec01895e22dd93f16f493db30a77a7c1b148f2) or any earlier releases that contain the same code. No specific version range is listed, so any instance of the application running prior to a fix that removes or protects this endpoint is vulnerable.

The CVSS score of 5.3 indicates a moderate risk level. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting it may not be actively exploited yet. However, the attack requires only that the attacker is a legitimate authenticated user and can easily iterate auto‑increment bookId values to enumerate other users’ bookings. The lack of an explicit access control check makes exploitation straightforward once an attacker has legitimate credentials.