Information Disclosure in mall4j Shopping Cart

Executive Summary

CVE-2026-108690 is an information disclosure vulnerability in mall4j through version 4.0. It allows authenticated users to read other customers' shopping cart items due to an operator precedence error in the SQL filter for the getShopCartExpiryItems function. Attackers can send a GET request to /p/shopCart/expiryProdList to retrieve off-shelf product basket entries, including product details, SKUs, quantities, shop information, and promoter card numbers.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the endpoint GET /p/shopCart/expiryProdList returns cart data belonging to other users. Use a script to send authenticated requests and compare returned cart IDs with the authenticated user's own basket IDs. Look for exposure of product, SKU, quantity, shop, and promoter card numbers in responses.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with a valid storefront account to access sensitive cart data of other users. Exposed information includes product details, quantities, shop data, and promoter card numbers, which could lead to privacy violations, data leaks, or potential misuse of payment-related information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and insufficient protection of user information. It may also conflict with HIPAA if promoter card numbers or other sensitive data are considered protected health information, though HIPAA primarily applies to healthcare entities.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update mall4j to a patched version beyond 4.0. If an update is unavailable, restrict access to the /p/shopCart/expiryProdList endpoint to authenticated users only and review SQL query logic in BasketMapper.xml to ensure proper operator precedence in the getShopCartExpiryItems filter.

Useful 0 Not Useful 0