{"id":"CVE-2026-111615","kind":"vulnerability","aliases":["CVE-2026-111615"],"related":[],"title":"Mall4cloud: merchants can read other shops' buyer shipping addresses","description":"Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment orderAddrId values in GET /m/order/order_addr/{orderAddrId} requests to obtain consignee names, mobile numbers, addresses and post codes platform-wide.","summary":"Mall4cloud through 4.0 has an insecure direct object reference in the multishop order handler, so any logged-in merchant can request another shop's order address by changing the orderAddrId number. An attacker gets buyers' names, mobile numbers, addresses and post codes across the platform by enumerating sequential ids.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mall4cloud","fixed":[],"affected":"<= 4.0 (and master aa4af71)","ecosystem":"github"}],"ecosystems":[],"tags":["e-commerce","idor","java","mall4cloud","multi-tenant","package","self-hosted"],"not_affected_if":["no-merchant-accounts","single-merchant-deployment"],"how_to_check":"- Mall4cloud 4.0 and earlier (including current master, commit aa4af71) is affected; check the tag or pom.xml version.\n- Open mall4cloud-order/.../controller/multishop/OrderController.java: if getOrderAddr calls orderAddrService.getByOrderAddrId(orderAddrId) without AuthUserContext.get().getTenantId(), you are exposed.\n- In staging with two merchant accounts, request GET /m/order/order_addr/{id} using shop A's session and an order_addr_id from shop B; data returned means vulnerable.\n- Look in gateway/access logs for one /m/** session walking sequential order_addr ids.","fix":"No fixed release exists as of 2026-10-25 (v4.0 is the latest tag and master still has the flaw). Patch your own copy: in multishop OrderController.getOrderAddr, resolve the order for AuthUserContext.get().getTenantId() and return the address only if it belongs to that shop; or add a shop predicate (join order_addr to order on shop_id) to OrderAddrMapper.getByOrderAddrId. Until then, block or rate-limit GET /m/order/order_addr/* at the gateway, since /m/order/order_info/{orderId} already returns the address for the merchant's own orders.","status":"open","published_at":"2026-10-16T18:17:40+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:36:39+00:00","updated_at":"2026-10-25T03:46:47+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:36:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Mall4cloud: merchants can read other shops' buyer shipping addresses","impact":"high","summary":"Mall4cloud through 4.0 has an insecure direct object reference in the multishop order handler, so any logged-in merchant can request another shop's order address by changing the orderAddrId number. An attacker gets buyers' names, mobile numbers, addresses and post codes across the platform by enumerating sequential ids.","category":"package","nicknames":[],"who_cares":["mall4cloud","java","e-commerce","multi-tenant"],"confidence":0.7,"needs_auth":"yes","worst_case":"Authenticated merchant reads all buyers' names, phones and addresses","analyst_note":"No fixed version or patch is named in the sources; find the upstream fix commit or release for getOrderAddr in the mall4cloud repository and the NVD entry for CVE-2026-111615.","how_to_check":"- Confirm the deployed Mall4cloud version is 4.0 or earlier, for example by checking the release tag or `pom.xml` version in the project.\n- Check whether `OrderController.getOrderAddr` in the multishop module verifies that the order address belongs to the requesting shop before returning it.\n- Test in staging with two merchant accounts: request `GET /m/order/order_addr/{orderAddrId}` for an order owned by the other shop and see whether it returns data.","needs_analyst":true,"not_affected_if":["single-merchant-deployment","no-merchant-accounts"],"who_is_affected":"Teams running Mall4cloud 4.0 or earlier with the multishop module, where multiple merchants have logins on the same platform. A single-merchant deployment with no third-party merchant accounts carries much less exposure. Teams that do not run Mall4cloud can skip this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000668,"input_tokens":3362,"output_tokens":663,"severity_before":"high"},"analyst_status":"done","analyst_note":"No fixed version or patch is named in the sources; find the upstream fix commit or release for getOrderAddr in the mall4cloud repository and the NVD entry for CVE-2026-111615.","search":"'-111615':12A,15A '-2026':11A,14A '/m/order/order_addr':117C '4.0':32B,82C 'across':73B 'address':9A,56B,69B,100C,126C 'allow':91C 'anoth':52B 'attack':63B,107C 'authent':92C 'auto':111C 'auto-incr':110C 'buyer':7A,65B,98C 'chang':58B 'code':72B,129C 'commerc':19B 'consigne':122C 'contain':83C 'cve':10A,13A 'direct':36B,86C 'e':18B 'e-commerc':17B 'enumer':77B,109C 'get':64B,116C 'getorderaddr':105C 'handler':43B,106C 'host':29B 'id':79B 'idor':20B 'increment':112C 'insecur':35B,85C 'java':21B 'log':47B 'logged-in':46B 'mall4cloud':1A,16A,22B,30B,80C 'merchant':2A,49B,93C 'mobil':67B,124C 'multi':24B 'multi-ten':23B 'multishop':41B,103C 'name':66B,123C 'number':61B,68B,125C 'object':37B,87C 'obtain':121C 'order':42B,55B 'orderaddrid':60B,113C,118C 'ordercontrol':104C 'packag':26B 'platform':75B,131C 'platform-wid':130C 'post':71B,128C 'read':4A,95C 'refer':38B,88C 'request':51B,119C 'self':28B 'self-host':27B 'sequenti':78B 'ship':8A,99C 'shop':6A,53B,97C 'tenant':25B 'valu':114C 'via':101C 'vulner':89C 'wide':132C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Mall4cloud (gz-yami) 4.0 or earlier, including the current master branch, with the multishop module, where more than one merchant can log in to the same platform. Any merchant account can read buyers' names, mobile numbers, addresses and post codes of other shops by counting up the sequential order_addr id. Single-merchant installs with no third-party seller accounts have little exposure; people not running Mall4cloud can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111615","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111615","severity":null,"published_at":"2026-10-16T18:17:40+00:00","modified_at":"2026-10-19T13:16:55+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111615:790","url":null,"severity":null,"published_at":"2026-10-25T03:46:47+00:00","modified_at":"2026-10-25T03:46:47+00:00","first_seen_at":"2026-10-25T03:46:47+00:00","fetched_at":"2026-10-25T03:46:47+00:00","note":"No upstream fix: v4.0 is latest release and master OrderController.getOrderAddr (read 2026-10-25) is still unscoped; reporter write-up (static analysis only, no runtime test, no public exploit) gives a code patch. Sources: VulnCheck advisory, hackmd, GitHub master."}],"documents":[{"id":3335,"url":"https://www.vulncheck.com/advisories/mall4cloud-through-4.0-idor-exposing-buyer-addresses-via-order-addr-endpoint","title":"VulnCheck: Mall4cloud through 4.0 IDOR via order_addr endpoint","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3336,"url":"https://hackmd.io/@hieuPenguinnn/mall4cloud-multishop-order-addr-cross-shop-idor","title":"Reporter write-up: cross-shop IDOR in mall4cloud getOrderAddr (static analysis, not runtime-tested)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":3337,"url":"https://raw.githubusercontent.com/gz-yami/mall4cloud/master/mall4cloud-order/src/main/java/com/mall4j/cloud/order/controller/multishop/OrderController.java","title":"mall4cloud master OrderController.java (getOrderAddr still unscoped)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}