Authentication Bypass in mall4j Allows Password Reset

Executive Summary

CVE-2026-102361 is a missing authentication vulnerability in mall4j through version 4.0. It affects the PUT /user/updatePwd endpoint, allowing unauthenticated attackers to reset any storefront account password by providing a target username in the request body. No verification is required, enabling full account takeover and access to sensitive data like orders and personal information.

Useful 0 Not Useful 0

Detection Guidance

Check if the PUT /user/updatePwd endpoint is accessible without authentication. Use tools like curl to send a test request: curl -X PUT http://target/system/user/updatePwd -H 'Content-Type: application/json' -d '{"nickname":"target_user","password":"new_password"}'. If the request succeeds without authentication, the vulnerability exists.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to take over any user account by resetting passwords without authentication. Impact includes unauthorized access to personal data, order history, and potentially financial information. Attackers could impersonate users, make purchases, or exfiltrate sensitive data stored in the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR's data protection requirements by enabling unauthorized access to personal data. It may also breach HIPAA if the system handles protected health information. Organizations using mall4j could face compliance violations, legal penalties, and reputational damage due to unauthorized data exposure.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update mall4j to a patched version beyond 4.0. If an update is unavailable, restrict access to the /user/updatePwd endpoint using network-level controls or application firewalls. Implement authentication checks and require current password verification for password updates.

Useful 0 Not Useful 0