CVE-2026-105098

Overview

CVE-2026-105098 is an information disclosure vulnerability in the Support Ticket API of Omega Solution CoinEx Crypto 2025. The flaw allows remote attackers to read sensitive data by manipulating status, page, or count parameters. It is medium severity with low EPSS, indicating limited current exploitation risk.

Description

A security flaw has been discovered in Omega Solution CoinEx Crypto 2025. Affected is an unknown function of the file /ticket/customer of the component Support Ticket API. The manipulation of the argument status/page/count results in information disclosure. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The product web site does not exist anymore. Maybe the product got retired and/or replaced. The vendor was contacted early about this disclosure but did not respond in any way.

Impact

Confidentiality is compromised as attackers can retrieve internal ticket data. Integrity is not directly affected. Availability remains unaffected. Defenders should treat exposed ticket information as sensitive and monitor for unauthorized access.

Remediation

If the system is still in use, block or restrict access to the /ticket/customer endpoint, enforce strict input validation on status, page, and count parameters, and monitor for anomalous requests. If the product is retired, decommission any remaining instances and remove the API from exposure.

Risk context

Medium severity with CVSS 4.3 and EPSS 0.00279 suggests low likelihood of widespread exploitation but defenders should still address promptly to prevent potential data leakage.

Affected products

• Omega Solution CoinEx Crypto 2025