macrozheng mall CVE-2026-10070

Q: What is the CVSS score of CVE-2026-10070?

CVE-2026-10070 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33356 MEDIUM

Improper Authorization (CWE-285)

2026-05-29 VulDB

GHSA-cv9f-r9m5-v3ww

Authentication Bypass Mall Macrozheng

5.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

May 29, 2026 - 18:22 NVD

4.7 (MEDIUM) 5.1 (MEDIUM)

Analysis Generated

May 29, 2026 - 17:56 vuln.today

DescriptionCVE.org

A vulnerability was found in macrozheng mall up to 1.0.3. This affects an unknown function of the file /admin/update/ of the component Super Admin Password Handler. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

AnalysisAI

Improper authorization (CWE-285) in macrozheng mall up to version 1.0.3 allows a network-reachable, high-privileged authenticated attacker to perform unauthorized operations via the /admin/update/ Super Admin Password Handler endpoint. The intelligence tags this as an authentication bypass, suggesting a higher-privileged admin role boundary can be crossed - potentially allowing one admin to manipulate super admin credentials beyond their authorized scope. No public exploit identified at time of analysis; however, vendor behavior (deleting the GitHub disclosure issue without explanation and ignoring email contact) creates significant uncertainty around patch availability and actual vulnerability scope.

Technical ContextAI

macrozheng mall is an open-source Java-based e-commerce backend system available at github.com/macrozheng/mall, identified via CPE cpe:2.3:a:macrozheng:mall:*:*:*:*:*:*:*:*. The vulnerable component is the /admin/update/ endpoint, specifically its Super Admin Password Handler - a privileged function responsible for updating super administrator credentials. CWE-285 (Improper Authorization) indicates the application fails to correctly enforce authorization logic: the system authenticates the caller but does not adequately verify whether that caller is permitted to perform the specific operation (e.g., modifying a super admin password). This class of flaw commonly arises when role-hierarchy checks are absent or bypassable, allowing a lower-tier admin to invoke privileged functions reserved for the super admin role.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor deleted the GitHub issue without explanation and did not respond to responsible disclosure contact. As an immediate compensating control, restrict access to the /admin/update/ endpoint at the WAF or reverse proxy layer to only the specific IP addresses of legitimate super admin operators, reducing exposure even if the authorization flaw persists in application logic. Implement strict role separation in any admin account provisioning, ensuring standard admin accounts are not granted access paths to super admin password management functions. Enable detailed audit logging on all requests to /admin/update/ and alert on any password-change events for the super admin account originating from non-super-admin sessions. Organizations should monitor the project repository at https://github.com/macrozheng/mall/ for any future patch release and treat this endpoint as high-sensitivity until a fix is confirmed.