CVE-2026-102361
CriticalCVSS 9.1Summary
mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling account takeover and access to orders and personal data.
Risk Assessment
An unauthenticated attacker can take over user accounts, gaining access to sensitive data, which may lead to privacy breaches and financial losses.
Recommendation
Update mall4j to a patched version immediately and implement additional authentication mechanisms, such as identity verification before password changes.
Other vulnerabilities in mall4j
See all- CVE-2026-102367Medium
mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Disabled user accounts can indefinitely renew their sessions through the POST /token/refresh endpoint, retaining access that account disabling was intended to remove.
- CVE-2026-102366Medium
mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers when accessed from the local storage path, resulting in stored cross-site scripting.
- CVE-2026-102365Medium
mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal information.
- CVE-2026-102364Medium
mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking @PreAuthorize permission checks, including menu listings, file uploads, and configuration endpoints.
- CVE-2026-102363Low
mall4j through version 4.0 has a missing authentication vulnerability in the DeliveryController checkDelivery endpoint, allowing unauthenticated attackers to read shipment tracking information by supplying an order number. Attackers can access carrier names, waybill numbers, and complete logistics trails for any order without authentication or ownership verification.
- CVE-2026-102362Medium
mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can delete arbitrary product reviews by supplying the prodCommId parameter without authorization checks.
Original NVD description (English source)
mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling account takeover and access to orders and personal data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS