rootpwn

medium · CVSS v3 4.3 · CVSS v4 5.3 · EPSS 0.00294

CVE-2026-105097

CVE-2026-105097 is an authorization bypass in the Customer Information API of Omega Solution CoinEx Crypto 2025. By manipulating the ID argu

Overview

CVE-2026-105097 is an authorization bypass in the Customer Information API of Omega Solution CoinEx Crypto 2025. By manipulating the ID argument in the /customer-currency/ endpoint, attackers can gain unauthorized access to customer data. The vulnerability is remotely exploitable and publicly documented.

Description

A vulnerability was identified in Omega Solution CoinEx Crypto 2025. This impacts an unknown function of the file /customer-currency/ of the component Customer Information API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The product web site does not exist anymore. Maybe the product got retired and/or replaced. The vendor was contacted early about this disclosure but did not respond in any way.

Impact

The flaw allows attackers to read or modify customer currency information, compromising confidentiality and integrity of financial data. It also undermines availability if abused to flood the API. Defenders should be aware that any system exposing this API is at risk.

Remediation

Apply the vendor’s patch or update to the latest version if available. If no patch exists, restrict access to the /customer-currency/ endpoint, enforce strict role‑based access controls, validate and sanitize the ID parameter, and monitor for anomalous API usage. Consider disabling the endpoint until a fix is applied.

Risk context

Severity is medium (CVSS v3 4.3, v4 5.3) with a low EPSS of 0.00294, indicating a low probability of exploitation but still actionable due to public exploit availability.

Affected products

  • Omega Solution CoinEx Crypto 2025

Scores

Severity
medium
CVSS v2
4
CVSS v3
4.3
CVSS v4
5.3
EPSS
0.00294

authorization-bypass API customer-currency remote-exploit medium-severity

← All CVEs

Related CVEs

medium

CVE-2026-105144

A flaw has been found in Drogon up to 1.9.13-1/10.0-beta.3 on Windows. Affected is the function StaticFileRouter::route of the file lib/src/StaticFileRouter.cc of the component Static File Router. Executing a manipulation can lead to path traversal. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

medium

CVE-2026-105205

SiYuan versions prior to 3.8.5 allow publish‑mode readers to retrieve backlink block IDs and reference counts from password‑protected or publish‑disabled documents via API calls. This exposes hidden metadata that should remain confidential. The flaw is exploitable by sending POST requests to /api/block/getDocInfo or getDocsInfo for a published document ID.

View analysis

medium

CVE-2026-97927

The CVE-2026-97927 flaw in the Linux kernel’s UFS filesystem causes an oops during mount teardown when cylinder group reading fails, potentially crashing the kernel. It occurs only when a writable UFS image has a corrupted first cylinder group. The issue is mitigated by applying the kernel patch that reorders root dentry creation.

View analysis

medium

CVE-2026-105096

CVE-2026-105096 is an authorization bypass vulnerability in the Customer Profile API of Omega Solution CoinEx Crypto 2025. By manipulating the ID parameter in the /customer/ endpoint, an attacker can gain unauthorized access to customer data. The flaw is exploitable remotely and has been publicly disclosed.

View analysis