CVE-2026-111615
Mall4cloud through 4.0 IDOR Exposing Buyer Addresses via order_addr Endpoint
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment orderAddrId values in GET /m/order/order_addr/{orderAddrId} requests to obtain consignee names, mobile numbers, addresses and post codes platform-wide.
| CWE | CWE-639 |
| Vendor | gz-yami |
| Product | mall4cloud |
| Published | Oct 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for gz-yami mall4cloud
Be the first to know when new medium vulnerabilities affecting gz-yami mall4cloud are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
gz-yami / mall4cloud
0 ≤ 4.0
References
hackmd.io: https://hackmd.io/@hieuPenguinnn/mall4cloud-multishop-order-addr-cross-shop-idor github.com: https://github.com/gz-yami/mall4cloud/blob/v4.0/mall4cloud-order/src/main/java/com/mall4j/cloud/order/controller/multishop/OrderController.java#L75-L80 github.com: https://github.com/gz-yami/mall4cloud/blob/v4.0/mall4cloud-order/src/main/resources/mapper/OrderAddrMapper.xml#L27-L29 vulncheck.com: https://www.vulncheck.com/advisories/mall4cloud-through-4.0-idor-exposing-buyer-addresses-via-order-addr-endpoint
Credits
hieuPenguinnn