CVE-2026-110613

Deferred Deferred - Pending Action

Missing Authorization in Youlai-Mall Exposes Customer Orders

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. Attackers can page through the oms_order table using a self-registered account to read order ids, order_sn values, member ids, payment amounts, and order status.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110613

EUVD

EUVD-2026-101241

Affected Vendors & Products

Vendor	Product	Version / Range
youlaitech	youlai-mall	de86041995fa3a8b1e959b86232cb9f0bf52ff46

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is a missing authorization flaw in the youlai-mall e-commerce application. It allows authenticated users to view all customer orders through the app's order list endpoint. The issue stems from improper access controls that fail to restrict data to the authenticated user's own orders.

Detection Guidance

To detect this vulnerability, check if the GET /mall-oms/app-api/v1/orders endpoint returns orders for all members instead of just the authenticated user. Use tools like curl to test the endpoint with a valid session token. Example: curl -H 'Authorization: Bearer <token>' 'http://<target>/mall-oms/app-api/v1/orders?page=1&size=100' and verify if order data from multiple members is exposed.

Impact Analysis

An attacker with a self-registered account can access sensitive order details of other customers. This includes order IDs, order numbers, member IDs, payment amounts, and order statuses. The attacker can enumerate orders by adjusting pagination parameters to view all orders in the system.

Compliance Impact

This vulnerability likely violates data protection regulations like GDPR and HIPAA by exposing sensitive customer information without proper authorization. It results in unauthorized access to personally identifiable information and financial data, which are protected under these standards.

Mitigation Strategies

Immediately update to the latest version of youlai-mall beyond commit 9f62de8. Apply a patch that adds member ID filtering in the OrderServiceImpl.getOrderPage method and includes member_id in the OmsOrderMapper.xml WHERE clause. Temporarily restrict access to the /mall-oms/app-api/v1/orders endpoint if an update is not immediately possible.

Hi! I’m here to help you understand CVE-2026-110613. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70