Is there a public PoC exploit available for CVE-2025-15086?

Yes, a public proof-of-concept exploit is available for CVE-2025-15086. Prioritise patching immediately. EPSS: 0.0%.

Youlai Mall CVE-2025-15086

Q: What is the CVSS score of CVE-2025-15086?

CVE-2025-15086 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Incorrect Privilege Assignment (CWE-266)

2025-12-25 cna@vuldb.com

Java Information Disclosure Youlai Mall Youlai

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 03:00 vuln.today

DescriptionCVE.org

A weakness has been identified in youlaitech youlai-mall 1.0.0/2.0.0. This impacts the function getMemberByMobile of the file mall-ums/ums-boot/src/main/java/com/youlai/mall/ums/controller/app/MemberController.java. This manipulation causes improper access controls. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper access controls in Youlai Mall 1.0.0 and 2.0.0 allow authenticated remote attackers to disclose member information via the getMemberByMobile endpoint in MemberController.java. The vulnerability has publicly available exploit code and affects a core user management function, though the EPSS score of 0.04% suggests limited real-world exploitation despite public availability of proof-of-concept.

Technical ContextAI

The vulnerability exists in the MemberController.java file of the mall-ums (User Management Service) component in Youlai Mall, a Java-based e-commerce platform. The getMemberByMobile function fails to properly validate user access controls when querying member information by mobile phone number, allowing authenticated users to retrieve sensitive data they should not have access to. This is classified as CWE-266 (Improper Privilege Management), indicating the application does not correctly enforce authorization boundaries between different privilege levels or user roles.

RemediationAI

No vendor-released patch has been identified at time of analysis; the vendor did not respond to early disclosure notification. Immediate mitigations include: (1) implement strict role-based access control (RBAC) on the getMemberByMobile endpoint to ensure only administrators or authorized customer service roles can query member details by phone number; (2) add authorization checks to verify the requesting user's role before returning member data, and restrict access to only the caller's own member profile unless explicitly privileged; (3) audit and log all calls to getMemberByMobile with user identity and accessed phone numbers to detect suspicious queries; (4) consider temporarily disabling the getMemberByMobile endpoint if member lookup by phone is not essential for authenticated users and instead require administrators to use a separate admin panel. Organizations should monitor the GitHub issue (https://github.com/Hwwg/cve/issues/27) and VulDB (https://vuldb.com/?ctiid.338414) for vendor updates or alternative fix guidance from the security research community.