CVE-2026-110125

Deferred Deferred - Pending Action

Authenticated Member Order Manipulation in Waynboot-mall

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by supplying their order identifiers. Attackers can enumerate sequential order ids or serial numbers via detail, cancel, confirm, delete and refund endpoints to read recipient addresses and phone numbers or disrupt orders.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110125

EUVD

EUVD-2026-98890

Affected Vendors & Products

Vendor	Product	Version / Range
wayn111	waynboot-mall	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an insecure direct object reference (IDOR) in Waynboot-mall through version 2.0.0. It allows authenticated users to access or modify other users' orders by using their order identifiers. Attackers can guess sequential order IDs or serial numbers to view sensitive data like recipient addresses and phone numbers or disrupt orders.

Detection Guidance

To detect this vulnerability, monitor API endpoints like /detail, /cancel, /confirm, /delete, and /refund for unusual access patterns or sequential order ID enumeration. Check application logs for repeated requests to these endpoints with varying order IDs.

Impact Analysis

If you use Waynboot-mall, an attacker could access your personal order details, modify or cancel your orders, or disrupt your transactions. This could lead to financial loss, privacy breaches, or inconvenience due to unauthorized order changes.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data like addresses and phone numbers without consent. For HIPAA, if order details include protected health information, unauthorized access could breach compliance. Organizations may face legal penalties and reputational damage.

Mitigation Strategies

Implement access controls to restrict authenticated users from accessing or modifying orders not belonging to them. Validate user permissions on all order-related endpoints and ensure proper session management to prevent unauthorized enumeration of order IDs.

Hi! I’m here to help you understand CVE-2026-110125. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70