Live › vulnerability › CVE-2026-111615
Go to dashboardMall4cloud through 4.0 has an insecure direct object reference in the multishop order handler, so any logged-in merchant can request another shop's order address by changing the orderAddrId number. An attacker gets buyers' names, mobile numbers, addresses and post codes across the platform by enumerating sequential ids.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone running Mall4cloud (gz-yami) 4.0 or earlier, including the current master branch, with the multishop module, where more than one merchant can log in to the same platform. Any merchant account can read buyers' names, mobile numbers, addresses and post codes of other shops by counting up the sequential order_addr id. Single-merchant installs with no third-party seller accounts have little exposure; people not running Mall4cloud can skip this.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| mall4cloud | github | <= 4.0 (and master aa4af71) | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment orderAddrId values in GET /m/order/order_addr/{orderAddrId} requests to obtain consignee names, mobile numbers, addresses and post codes platform-wide.
This page as .md · .json · in your agent: get_signal("CVE-2026-111615")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.