A vulnerability, which was classified as problematic, has been found in Zhong Bang CRMEB up to 5.6.3. This affects the function
detail/tidyOrder of the file /api/store_integral/order/detail/:uni. The manipulation of the argument order_id leads to improper authorization.
This vulnerability is documented as CVE-2026-1733. The attack can be initiated remotely. Additionally, an exploit exists.
The vendor was contacted early about this disclosure but did not respond in any way.
