CVE-2026-102365
MediumCVSS 6.5Summary
mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal information.
Risk Assessment
The risk is a breach of customer privacy and potential misuse of personal data for social engineering or identity theft, which may lead to legal consequences and loss of trust.
Recommendation
It is recommended to add proper authorization checks (e.g., user role verification) to all UserAddrController endpoints and restrict access to address data only to authorized personnel.
Other vulnerabilities in mall4j
See all- CVE-2026-102367Medium
mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Disabled user accounts can indefinitely renew their sessions through the POST /token/refresh endpoint, retaining access that account disabling was intended to remove.
- CVE-2026-102366Medium
mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers when accessed from the local storage path, resulting in stored cross-site scripting.
- CVE-2026-102364Medium
mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking @PreAuthorize permission checks, including menu listings, file uploads, and configuration endpoints.
- CVE-2026-102363Low
mall4j through version 4.0 has a missing authentication vulnerability in the DeliveryController checkDelivery endpoint, allowing unauthenticated attackers to read shipment tracking information by supplying an order number. Attackers can access carrier names, waybill numbers, and complete logistics trails for any order without authentication or ownership verification.
- CVE-2026-102362Medium
mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can delete arbitrary product reviews by supplying the prodCommId parameter without authorization checks.
- CVE-2026-102361Critical
mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling account takeover and access to orders and personal data.
Original NVD description (English source)
mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS