CVE-2026-110608

Deferred Deferred - Pending Action

Insecure Direct Object Reference in BizSpring Shop Order Handling

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members' orders by supplying their orderId. Attackers can cancel victims' pending orders to release allocated stock or confirm receipt of shipped orders, advancing fulfilment and settlement without the victim's consent.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110608

EUVD

EUVD-2026-101236

Affected Vendors & Products

Vendor	Product	Version / Range
BizSpring	BizSpring	Shop 0
BizSpring	BizSpring	Java Mall 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-110608 is an Insecure Direct Object Reference (IDOR) vulnerability in BizSpring Shop and BizSpring Java Mall. It allows authenticated users to manipulate other users' orders by providing their orderId. Specifically, attackers can cancel pending orders to free up stock or confirm receipt of shipped orders without the legitimate user's consent. This occurs due to missing ownership checks in the OrderController's cancel and receive handlers.

Detection Guidance

To detect this IDOR vulnerability in BizSpring Shop or Java Mall, inspect the OrderController endpoints for `/member/order/cancel` and `/member/order/receive`. Check if these endpoints validate order ownership by comparing the authenticated user's ID with the order's owner ID. Look for missing authorization checks in the code or unusual order status changes without user consent.

Impact Analysis

This vulnerability can lead to financial losses for merchants if attackers cancel pending orders or confirm receipt of shipped orders fraudulently. Users may experience disrupted transactions or premature fund releases. Attackers could also manipulate order statuses to gain unauthorized access to goods or services without payment.

Compliance Impact

This vulnerability could lead to unauthorized access and manipulation of user orders, potentially violating data integrity and privacy principles under GDPR and HIPAA. GDPR requires protecting personal data and ensuring lawful processing, while HIPAA mandates safeguarding protected health information. Unauthorized order cancellations or confirmations may expose sensitive user data or financial transactions, risking non-compliance with these regulations.

Mitigation Strategies

Immediately update to the latest patched version of BizSpring Shop or Java Mall. Implement strict ownership validation in the `/member/order/cancel` and `/member/order/receive` endpoints by ensuring the authenticated user matches the order owner. Add input validation to prevent parameter manipulation and enable proper authorization checks for all order-related operations.

Hi! I’m here to help you understand CVE-2026-110608. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70