---
id: "CVE-2026-111615"
kind: "vulnerability"
aliases: ["CVE-2026-111615"]
title: "Mall4cloud: merchants can read other shops' buyer shipping addresses"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "mall4cloud", "fixed": [], "affected": "<= 4.0 (and master aa4af71)", "ecosystem": "github"}]
ecosystems: []
tags: ["e-commerce", "idor", "java", "mall4cloud", "multi-tenant", "package", "self-hosted"]
not_affected_if: ["no-merchant-accounts", "single-merchant-deployment"]
published_at: "2026-10-16T18:17:40+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:46:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111615", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:46:47+00:00"}]
---

# Mall4cloud: merchants can read other shops' buyer shipping addresses

Mall4cloud through 4.0 has an insecure direct object reference in the multishop order handler, so any logged-in merchant can request another shop's order address by changing the orderAddrId number. An attacker gets buyers' names, mobile numbers, addresses and post codes across the platform by enumerating sequential ids.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:mall4cloud affected <= 4.0 (and master aa4af71) fixed ?

## How to check

- Mall4cloud 4.0 and earlier (including current master, commit aa4af71) is affected; check the tag or pom.xml version.
- Open mall4cloud-order/.../controller/multishop/OrderController.java: if getOrderAddr calls orderAddrService.getByOrderAddrId(orderAddrId) without AuthUserContext.get().getTenantId(), you are exposed.
- In staging with two merchant accounts, request GET /m/order/order_addr/{id} using shop A's session and an order_addr_id from shop B; data returned means vulnerable.
- Look in gateway/access logs for one /m/** session walking sequential order_addr ids.

## Fix

No fixed release exists as of 2026-10-25 (v4.0 is the latest tag and master still has the flaw). Patch your own copy: in multishop OrderController.getOrderAddr, resolve the order for AuthUserContext.get().getTenantId() and return the address only if it belongs to that shop; or add a shop predicate (join order_addr to order on shop_id) to OrderAddrMapper.getByOrderAddrId. Until then, block or rate-limit GET /m/order/order_addr/* at the gateway, since /m/order/order_info/{orderId} already returns the address for the merchant's own orders.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111615
- 2026-10-25T03:46:47+00:00 analyst — No upstream fix: v4.0 is latest release and master OrderController.getOrderAddr (read 2026-10-25) is still unscoped; reporter write-up (static analysis only, no runtime test, no public exploit) gives a code patch. Sources: VulnCheck advisory, hackmd, GitHub master.

## Documents

- [advisory] VulnCheck: Mall4cloud through 4.0 IDOR via order_addr endpoint https://www.vulncheck.com/advisories/mall4cloud-through-4.0-idor-exposing-buyer-addresses-via-order-addr-endpoint
- [describes] Reporter write-up: cross-shop IDOR in mall4cloud getOrderAddr (static analysis, not runtime-tested) https://hackmd.io/@hieuPenguinnn/mall4cloud-multishop-order-addr-cross-shop-idor
- [mentions] mall4cloud master OrderController.java (getOrderAddr still unscoped) https://raw.githubusercontent.com/gz-yami/mall4cloud/master/mall4cloud-order/src/main/java/com/mall4j/cloud/order/controller/multishop/OrderController.java

## From the sources

Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment orderAddrId values in GET /m/order/order_addr/{orderAddrId} requests to obtain consignee names, mobile numbers, addresses and post codes platform-wide.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_