CVE-2026-110120

MEDIUM 5.4

yshopmall through 2.0.0 IDOR via After-Sales API in StoreAfterSalesController

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other members' data by supplying their after-sales id and orderCode. Attackers can call deleteAfterSalesOrder, addLogisticsInformation, or GET /applyForAfterSales/{key} to view other members' order items and tamper with or delete their after-sales records.

CWE	CWE-639
Vendor	guchengwuyue
Product	yshopmall
Published	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for guchengwuyue yshopmall

Be the first to know when new medium vulnerabilities affecting guchengwuyue yshopmall are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

guchengwuyue / yshopmall

0 ≤ 2.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/yshopmall-member-api-ownership-idor github.com: https://github.com/guchengwuyue/yshopmall/blob/d1b20a2d76dfd98985410116db3aca8aca193b26/yshop-mall-boot/yshop-app/src/main/java/co/yixiang/sales/rest/StoreAfterSalesController.java#L151-L187 github.com: https://github.com/guchengwuyue/yshopmall/blob/d1b20a2d76dfd98985410116db3aca8aca193b26/yshop-mall-boot/yshop-mall/src/main/java/co/yixiang/modules/sales/service/impl/StoreAfterSalesServiceImpl.java#L353-L383 vulncheck.com: https://www.vulncheck.com/advisories/yshopmall-through-2.0.0-idor-via-after-sales-api-in-storeaftersalescontroller

Credits

hieuPenguinnn