---
id: "CVE-2026-116015"
kind: "vulnerability"
aliases: ["CVE-2026-116015"]
title: "yudao-cloud: authenticated members can read other members' after-sale logs"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["e-commerce", "java", "other", "self-hosted", "yudao-cloud"]
not_affected_if: ["mall-trade-module-disabled", "no-member-self-signup"]
published_at: "2026-10-24T12:16:57+00:00"
first_seen_at: "2026-10-24T12:47:58+00:00"
updated_at: "2026-10-25T04:18:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116015", "first_seen_at": "2026-10-24T12:47:58+00:00"}]
---

# yudao-cloud: authenticated members can read other members' after-sale logs

yudao-cloud through 2026.09 has an insecure direct object reference in its mall trade module. Any logged-in member can read other members' after-sale operation logs by changing the afterSaleId value, exposing refund amounts, status changes and timestamps.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the deployment runs yudao-cloud at a version through `2026.09`.
- Confirm whether the mall trade module is deployed, since the flaw sits in `GET /app-api/trade/after-sale-log/list`.
- Test with two member accounts whether one can request the other's after-sale IDs from that endpoint.

## Timeline

- 2026-10-24T12:47:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116015

## From the sources

yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members' after-sale operation logs by supplying arbitrary afterSaleId values. Attackers can enumerate sequential after-sale IDs against GET /app-api/trade/after-sale-log/list to expose refund amounts, status transitions and timestamps belonging to other members.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_