Critical Authentication Bypass in mall4j Java E-Commerce <=4.0 - CVE-2026-102361

Missing authorization checks in mall4j through 4.0 let any authenticated low-privilege account read the entire customer address book via the admin-side GET endpoints /user/addr/page and /user/addr/info in UserAddrController, exposing names, phone numbers and postal addresses. Exploitation requires only a valid, low-privileged login (PR:L) reachable over the network with no user interaction and no special configuration, and publicly available exploit code exists in a GitHub proof-of-concept repository. The flaw is a data-exposure issue (confidentiality only, no write or availability impact), and no vendor-released patch was identified at time of analysis.

Unauthenticated attackers can delete arbitrary product reviews in mall4j through 4.0 by sending DELETE requests to the /prodComm endpoint in ProdCommController, which applies no authentication or authorization checks to the prodCommId parameter (CWE-306). Publicly available exploit code exists, and no credentials or user interaction are required; the only prerequisite is knowing or enumerating a valid review ID. The impact is limited to integrity tampering with review records, with no confidentiality or availability loss assessed in our independent review, making this a low-severity data-tampering issue rather than a high-impact compromise.

Unauthenticated shipment-tracking disclosure in mall4j through version 4.0 lets remote attackers retrieve carrier names, waybill numbers, and full logistics trails for any order by calling the yami-shop-api DeliveryController checkDelivery endpoint with an order number and no credentials. Because the handler performs neither authentication nor ownership verification, any caller who can supply a valid order number - and sequential or guessable numbering would permit enumeration - can harvest tracking data in bulk. Publicly available exploit code exists (a proof-of-concept Python script), but the issue is not confirmed as actively exploited; per the independent assessment this is a real but low-to-moderate priority information-disclosure problem, since impact is limited to confidentiality of shipment metadata with no integrity or availability effects.

Disabled mall4j accounts (through 4.0) can indefinitely renew their sessions by calling POST /token/refresh, because the refresh flow issues a new token without re-checking the account's enabled flag, letting a user that an administrator deactivated retain the access they already had. The attacker must already hold a valid, non-expired refresh token obtained before deactivation, so this is an authenticated access-control persistence flaw (CVSS 5.3, CWE-613), not an unauthenticated bypass or a route to new accounts. Publicly available exploit code exists (a proof-of-concept Python script), but no active exploitation has been confirmed (not in CISA KEV), and the practical impact is limited to preserving prior access rather than escalating privileges.

Vertical privilege escalation in mall4j through 4.0 lets any self-registered storefront customer reach back-office administrative endpoints - including menu listings, file uploads, and configuration routes - by presenting the same sa-token session that was issued for the customer storefront. The flaw (CWE-287 improper authentication) is that the session validation layer never checks the sysType field that is supposed to separate customer from admin identity, so only endpoints already guarded by @PreAuthorize remain safe. Independently assessed at CVSS 5.3 with limited confidentiality and integrity impact, this is a genuine but moderate-priority privilege-escalation bug; publicly available exploit code exists, and there is no KEV-listed evidence of confirmed active exploitation.

Stored cross-site scripting in mall4j through 4.0 arises from unrestricted file uploads in admin FileController endpoints that require only any valid authenticated token and do not validate uploaded file types. An authenticated attacker can upload HTML or SVG files that execute script in an administrator's browser when the administrator opens the uploaded file from the local storage path, and publicly available exploit code exists. Real-world risk is modest because exploitation requires a token and privileged-user interaction, and the impact is client-side stored XSS rather than server-side code execution.