CVE-2026-111615
Received Received - Intake

Insecure Direct Object Reference in Mall4cloud Exposes Buyer Shipping Data

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment orderAddrId values in GET /m/order/order_addr/{orderAddrId} requests to obtain consignee names, mobile numbers, addresses and post codes platform-wide.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111615
EUVD
EUVD-2026-103037

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gz-yami mall4cloud 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-111615 is an Insecure Direct Object Reference (IDOR) vulnerability in the mall4cloud e-commerce platform through version 4.0. It allows authenticated merchants to access other shops' buyer shipping addresses by manipulating auto-increment orderAddrId values in GET requests to /m/order/order_addr/{orderAddrId}. The vulnerability exists due to missing tenant (shop) validation in the OrderController's getOrderAddr handler.

Detection Guidance

To detect this IDOR vulnerability, monitor GET requests to /m/order/order_addr/{orderAddrId} endpoints. Check for repeated requests with sequential orderAddrId values from authenticated merchants. Look for responses containing buyer shipping details (names, addresses, phone numbers) not belonging to the requesting shop.

Impact Analysis

This vulnerability allows attackers to enumerate orderAddrId values and retrieve sensitive buyer information across all shops on the platform. Exposed data includes consignee names, mobile numbers, full addresses, and post codes. Attackers need only to be authenticated merchants to exploit this flaw, potentially leading to large-scale privacy breaches of customer shipping data.

Compliance Impact

This vulnerability likely violates GDPR's data protection principles by exposing personal data (shipping addresses) without proper authorization. It could also breach HIPAA if shipping addresses contain protected health information. Organizations using affected mall4cloud versions may face regulatory fines, legal liabilities, and reputational damage due to unauthorized personal data disclosure.

Mitigation Strategies

Immediately update mall4cloud to a patched version beyond 4.0. If unavailable, implement server-side validation to verify the orderAddrId belongs to the requesting merchant's shop before returning data. Restrict access to the /m/order/order_addr/{orderAddrId} endpoint to authorized users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111615. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart