CVE-2026-109406

MEDIUM 5.4

macrozheng mall mall-portal generateOrder OmsPortalOrderServiceImpl logic error

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

A weakness has been identified in macrozheng mall up to 1.0.3. This vulnerability affects the function OmsPortalOrderServiceImpl of the file /order/generateOrder of the component mall-portal. This manipulation of the argument coupon_amount/pay_amount causes business logic errors. The attack is possible to be carried out remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.

CWE	CWE-840
Vendor	macrozheng
Product	mall
Published	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for macrozheng mall

Be the first to know when new medium vulnerabilities affecting macrozheng mall are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

macrozheng / mall

1.0.0 1.0.1 1.0.2 1.0.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/416948 vuldb.com: https://vuldb.com/vuln/416948/cti vuldb.com: https://vuldb.com/cve/CVE-2026-109406 vuldb.com: https://vuldb.com/submit/979830 github.com: https://github.com/macrozheng/mall/issues/1002 github.com: https://github.com/macrozheng/mall/

Credits

🔍 peanutbutter (VulDB User) VulDB CNA Team