Live › vulnerability › CVE-2026-116015
Go to dashboardyudao-cloud through 2026.09 has an insecure direct object reference in its mall trade module. Any logged-in member can read other members' after-sale operation logs by changing the afterSaleId value, exposing refund amounts, status changes and timestamps.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 12:47 UTC. All times on this page are UTC.
Storefronts built on yudao-cloud with the mall trade module enabled and member accounts that can sign in. The exposure comes from the after-sale log endpoint not checking that the requested afterSaleId belongs to the caller. Deployments without the mall trade module, or where members cannot register, have less exposure.
No product ranges from the sources yet.
2026.09.GET /app-api/trade/after-sale-log/list.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members' after-sale operation logs by supplying arbitrary afterSaleId values. Attackers can enumerate sequential after-sale IDs against GET /app-api/trade/after-sale-log/list to expose refund amounts, status transitions and timestamps belonging to other members.
This page as .md · .json · in your agent: get_signal("CVE-2026-116015")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.