CVE-2026-102362
Received Received - Intake

Unauthenticated Product Review Deletion in mall4j

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: VulnCheck

Description
mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can delete arbitrary product reviews by supplying the prodCommId parameter without authorization checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-29
Last Modified
2026-09-29
Generated
2026-09-29
AI Q&A
2026-09-29
EPSS Evaluated
N/A
NVD
CVE-2026-102362
EUVD
EUVD-2026-88578

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-102362 is a missing authentication vulnerability in the mall4j e-commerce platform through version 4.0. It allows unauthenticated attackers to delete any product review by sending a DELETE request to the /prodComm endpoint with a prodCommId parameter. The system fails to verify if the requester has permission to perform this action.

Detection Guidance

Check if unauthenticated DELETE requests to /prodComm with prodCommId parameter succeed. Use curl to test: curl -X DELETE http://<target>/prodComm?prodCommId=<id>. If the review is deleted without authentication, the system is vulnerable.

Impact Analysis

This vulnerability enables attackers to delete product reviews without authorization. This could allow manipulation of product ratings, removal of negative feedback, or deletion of important customer comments. Businesses relying on this platform may experience distorted product reputations and loss of customer trust.

Compliance Impact

This vulnerability could potentially violate GDPR and HIPAA by allowing unauthorized deletion of product reviews, which may include sensitive personal data. Under GDPR, unauthorized deletion of user-generated content containing personal data may infringe on data subject rights. HIPAA could be implicated if the reviews contain protected health information, as unauthorized deletion may compromise data integrity requirements.

Mitigation Strategies

Immediately update mall4j to a version beyond 4.0. If an update is unavailable, implement authentication checks on the DELETE /prodComm endpoint in ProdCommController. Restrict access to this endpoint to authenticated users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102362. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart