CVE-2026-102365CWE-862broken-access-control

CVE-2026-102365

Medium · published September 29, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
14.1
In the wild
Unconfirmed
What it is

mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal information.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00238 · 14.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-29T04:17Z
References (4)
https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/A02_admin_useraddr_bfla.py · [email protected]https://github.com/gz-yami/mall4j · [email protected]https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-admin/src/main/java/com/yami/shop/admin/controller/UserAddrController.java#L46-L61 · [email protected]https://www.vulncheck.com/advisories/mall4j-through-4.0-missing-authorization-in-admin-user-address-endpoints · [email protected]
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 28 SEP 23:34Z
    mall4j through 4.0 Missing Authorization in Admin User Address Endpoints
    cvelistv5