CVE-2026-110125

6.3Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-639

Impact

Authenticated members can view and tamper with other users' orders, exposing personal details like recipient addresses and phone numbers. The attacker only needs a valid low-privilege user account and network access to the API.

Root cause

Mobile order API endpoints fail to verify that the requesting authenticated user owns the specified order ID or serial number before performing read, cancel, confirm, delete, or refund actions.

Affected systems

Waynboot-mall through version 2.0.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Fix & remediation

No official patched release is listed; inspect upstream repository commits or patch MobileOrderServiceImpl.java and OrderController.java to enforce user ownership checks on order operations. As an interim workaround, restrict or disable affected mobile order endpoints (detail, cancel, confirm, delete, refund) at the API gateway or reverse proxy.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by supplying their order identifiers. Attackers can enumerate sequential order ids or serial numbers via detail, cancel, confirm, delete and refund endpoints to read recipient addresses and phone numbers or disrupt orders.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110125