CVE-2026-111615
mediumMall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addre…
Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment orderAddrId values in GET /m/order/order_addr/{orderAddrId} requests to obtain consignee names, mobile numbers, addresses and post codes platform-wide.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/gz-yami/mall4cloud/blob/v4.0/mall4cloud-order/src/main/java/com/mall4j/... disclosure@vulncheck.com
- https://github.com/gz-yami/mall4cloud/blob/v4.0/mall4cloud-order/src/main/resources/mapper... disclosure@vulncheck.com
- https://hackmd.io/@hieuPenguinnn/mall4cloud-multishop-order-addr-cross-shop-idor disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/mall4cloud-through-4.0-idor-exposing-buyer-addresses-... disclosure@vulncheck.com
- https://hackmd.io/@hieuPenguinnn/mall4cloud-multishop-order-addr-cross-shop-idor 134c704f-9b21-4f2e-91b3-4a467353bcc0