CVE-2026-110126
5.4MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-639
Impact
Authenticated users can modify or delete shipping addresses belonging to any other member. To exploit it, an attacker needs a standard account and network access to the mobile API.
Root cause
The AddressController endpoints fail to verify that the requesting user owns the target addressId before processing updates or deletions.
Affected systems
waynboot-mall through 2.0.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Fix & remediation
Apply commit 0ef8fa4a951fc1f6d57f3e12e37c31490e886a64 or update past 2.0.0 once a fixed release is tagged. As an interim workaround, block or restrict access to POST /address and DELETE /address/* at the reverse proxy or API gateway.
$ git cherry-pick 0ef8fa4a951fc1f6d57f3e12e37c31490e886a64AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController that allows authenticated members to modify or delete other members' shipping addresses. Attackers can enumerate auto-increment address ids and send POST /address or DELETE /address/{addressId} requests to overwrite or remove victims' saved addresses.
References
- https://github.com/wayn111/waynboot-mall/blob/v2.0.0/waynboot-mobile-api/src/main/java/com/wayn/mobile/api/controller/AddressController.java#L44-L67
- https://github.com/wayn111/waynboot-mall/commit/0ef8fa4a951fc1f6d57f3e12e37c31490e886a64
- https://github.com/wayn111/waynboot-mall/releases/tag/v2.0.0
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/waynboot-mall-mobile-member-ownership-idor
- https://www.vulncheck.com/advisories/waynboot-mall-through-2.0.0-idor-via-mobile-address-endpoints