CVE-2026-102362

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-09-29

Last updated on: 2026-09-30

Assigner: VulnCheck

Description

mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can delete arbitrary product reviews by supplying the prodCommId parameter without authorization checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-30

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102362

EUVD

EUVD-2026-88578

Affected Vendors & Products

Vendor	Product	Version / Range
gz-yami	mall4j	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

CVE-2026-102362 is a missing authentication vulnerability in the mall4j e-commerce platform through version 4.0. It allows unauthenticated attackers to delete any product review by sending a DELETE request to the /prodComm endpoint with a prodCommId parameter. The system fails to verify if the requester has permission to perform this action.

Detection Guidance

Check if unauthenticated DELETE requests to /prodComm with prodCommId parameter succeed. Use curl to test: curl -X DELETE http://<target>/prodComm?prodCommId=<id>. If the review is deleted without authentication, the system is vulnerable.

Impact Analysis

This vulnerability enables attackers to delete product reviews without authorization. This could allow manipulation of product ratings, removal of negative feedback, or deletion of important customer comments. Businesses relying on this platform may experience distorted product reputations and loss of customer trust.

Compliance Impact

This vulnerability could potentially violate GDPR and HIPAA by allowing unauthorized deletion of product reviews, which may include sensitive personal data. Under GDPR, unauthorized deletion of user-generated content containing personal data may infringe on data subject rights. HIPAA could be implicated if the reviews contain protected health information, as unauthorized deletion may compromise data integrity requirements.

Mitigation Strategies

Immediately update mall4j to a version beyond 4.0. If an update is unavailable, implement authentication checks on the DELETE /prodComm endpoint in ProdCommController. Restrict access to this endpoint to authenticated users only.

Hi! I’m here to help you understand CVE-2026-102362. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70