CVE-2026-110120
MediumCVSS 5.4Summary
Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other members' data by supplying their after-sales id and orderCode. Attackers can call deleteAfterSalesOrder, addLogisticsInformation, or GET /applyForAfterSales/{key} to view other members' order items and tamper with or delete their after-sales records.
Risk Assessment
Attackers can view other users' order data and tamper with or delete their after-sales requests, potentially leading to fraud and loss of customer trust.
Recommendation
Implement after-sales record ownership verification in all related endpoints so users can only operate on their own requests, and secure identifiers against enumeration.
Other vulnerabilities in Yshopmall
See all- CVE-2026-110119High
Yshopmall through 2.0.0 contains an insecure direct object reference (IDOR) vulnerability in the member address API. Authenticated members can read, overwrite, and delete other members' shipping addresses by enumerating sequential address IDs via /address/detail/{id}, /address/del, and /address/edit.
- CVE-2026-75308Medium
In yshopmall version 3.3 and earlier, there is a Cross Site Scripting (XSS) vulnerability. The file upload endpoint /api/upload lacks file type validation. Attackers can upload files of any type, including HTML, JSP, and other executable files.
Original NVD description (English source)
Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other members' data by supplying their after-sales id and orderCode. Attackers can call deleteAfterSalesOrder, addLogisticsInformation, or GET /applyForAfterSales/{key} to view other members' order items and tamper with or delete their after-sales records.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS