CVE-2026-116015
Received Received - Intake

Insecure Direct Object Reference in yudao-cloud Mall Trade Module

Publication date: 2026-10-24

Last updated on: 2026-10-24

Assigner: VulnCheck

Description
yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members' after-sale operation logs by supplying arbitrary afterSaleId values. Attackers can enumerate sequential after-sale IDs against GET /app-api/trade/after-sale-log/list to expose refund amounts, status transitions and timestamps belonging to other members.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-24
Last Modified
2026-10-24
Generated
2026-10-24
AI Q&A
2026-10-24
EPSS Evaluated
N/A
NVD
CVE-2026-116015
EUVD
EUVD-2026-109273

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
YunaiV yudao-cloud 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Insecure Direct Object Reference (IDOR) vulnerability in yudao-cloud through version 2026.09. It allows authenticated members to access other members' after-sale operation logs by providing arbitrary after-sale IDs to the GET /app-api/trade/after-sale-log/list endpoint. The system fails to verify if the requested after-sale ID belongs to the logged-in user, enabling unauthorized data exposure.

Detection Guidance

To detect this vulnerability, monitor HTTP GET requests to /app-api/trade/after-sale-log/list with sequential afterSaleId parameters. Check for unauthorized access to after-sale logs belonging to other users. Use tools like curl to test the endpoint with different afterSaleId values while authenticated.

Impact Analysis

An attacker with a valid member account could enumerate sequential after-sale IDs to access sensitive information belonging to other members. This includes refund amounts, order status transitions, and timestamps. While it doesn't allow account takeover or write operations, it exposes financial and dispute-related data of other users.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR and HIPAA by exposing personally identifiable information and financial data of users without proper authorization. It represents a failure to implement adequate access controls for sensitive user data.

Mitigation Strategies

Apply the latest patches from the yudao-cloud repository that add ownership validation in the AfterSaleService. Ensure the endpoint /app-api/trade/after-sale-log/list checks if the afterSaleId belongs to the logged-in user before returning logs. Update to versions with the fix applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116015. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart