CVE-2026-110119
HighCVSS 7.1Summary
Yshopmall through 2.0.0 contains an insecure direct object reference (IDOR) vulnerability in the member address API. Authenticated members can read, overwrite, and delete other members' shipping addresses by enumerating sequential address IDs via /address/detail/{id}, /address/del, and /address/edit.
Risk Assessment
Attackers can access personally identifiable information (names, phone numbers, addresses) of other users and modify or delete their shipping addresses, leading to privacy breaches and potential fraud.
Recommendation
Update Yshopmall to a version later than 2.0.0 if available, or implement access controls verifying user ownership of each address. Also audit logs for unauthorized access to address endpoints.
Other vulnerabilities in Yshopmall
See all- CVE-2026-110120Medium
Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other members' data by supplying their after-sales id and orderCode. Attackers can call deleteAfterSalesOrder, addLogisticsInformation, or GET /applyForAfterSales/{key} to view other members' order items and tamper with or delete their after-sales records.
- CVE-2026-75308Medium
In yshopmall version 3.3 and earlier, there is a Cross Site Scripting (XSS) vulnerability. The file upload endpoint /api/upload lacks file type validation. Attackers can upload files of any type, including HTML, JSP, and other executable files.
Original NVD description (English source)
Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other members' shipping addresses. Attackers can enumerate sequential address ids via /address/detail/{id}, /address/del and /address/edit to expose recipient names, phone numbers and addresses, reassign them, or delete them.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS