CVE-2026-109410
2.4LowPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-682
Impact
High-privileged attackers can corrupt order money calculations remotely if a user interacts with the application. The attack requires high-privilege credentials and user interaction.
Root cause
An incorrect calculation flaw exists in the OmsOrderServiceImpl.updateMoneyInfo function handling the /order/update/moneyInfo endpoint.
Affected systems
macrozheng mall 1.0.3 commit dcaa93b
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Fix & remediation
No official patched release is specified; pull the latest commits from the upstream repository or restrict access to the /order/update/moneyInfo endpoint via your API gateway.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability has been found in macrozheng mall 1.0.3 dcaa93b. The impacted element is the function OmsOrderServiceImpl.updateMoneyInfo of the file /order/update/moneyInfo of the component mall-admin/mall-portal. The manipulation leads to incorrect calculation. The attack can be initiated remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.