Improper Authorization in mall4j Leading to Cart Item Deletion

Executive Summary

CVE-2026-108691 is an improper authorization vulnerability in the mall4j e-commerce platform (versions through 4.0). It allows authenticated storefront customers to delete other users' shopping cart items due to an operator precedence error in the SQL statement used by the cleanExpiryProdList endpoint. The flaw enables a single DELETE request to /p/shopCart/cleanExpiryProdList to remove all cart entries for products marked as off-shelf, even if those products are later restocked.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP DELETE requests to the endpoint /p/shopCart/cleanExpiryProdList. Check for requests from authenticated users that result in deletion of cart items not belonging to them. Review application logs for unusual deletion patterns or unauthorized access to other users' cart data.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to irreversible data loss for affected users. Attackers with an authenticated session can delete items from other users' carts, potentially causing inconvenience or financial loss if critical items are removed. The impact includes disruption of shopping experiences and potential loss of trust in the platform.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate GDPR's data integrity and availability principles by allowing unauthorized deletion of user cart data, which may include personal or sensitive information. It also risks non-compliance with HIPAA if the e-commerce system handles protected health information, as unauthorized data alteration or deletion could compromise patient confidentiality.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately patch mall4j to a version beyond 4.0. Implement strict input validation for the cleanExpiryProdList endpoint. Ensure SQL queries use explicit parentheses to enforce correct operator precedence. Restrict DELETE operations to only the authenticated user's own cart items.

Useful 0 Not Useful 0