macrozheng mall CVE-2026-109410

Exploitation requires an authenticated session with administrative privileges on the mall-admin backend (CVSS PR:H), plus operator interaction with the order-editing workflow (UI:P), because the vulnerable updateMoneyInfo logic is reached through the privileged /order/update/moneyInfo endpoint. There is no unauthenticated or anonymous path; the attacker must already hold admin-level access or hijack an admin session. Impact is bounded to incorrect calculation of order money fields (integrity only) - no data disclosure and no service disruption - which sharply limits realistic risk despite the network-reachable attack vector.

This is a genuinely low-priority, low-real-risk issue despite being remotely reachable. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N) scores 4.8 (Medium) and is internally consistent with the description: the vulnerable function OmsOrderServiceImpl.updateMoneyInfo lives in mall-admin, an administrative backend, so PR:H (high/admin privileges) is correct, and UI:P reflects that an operator action is involved. Impact is limited to low integrity (VI:L) with no confidentiality (VC:N) and no availability (VA:N) impact - consistent with CWE-682 (incorrect calculation), which here corrupts order money values rather than enabling code execution or data theft. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis. The signals do not conflict: a high-privilege, integrity-only flaw in an admin order-editing function is low risk because an attacker who already holds admin rights can typically alter order amounts through legitimate means anyway. One notable context flag: the vendor deleted the GitHub issue (#1004) without explanation, so vendor-confirmed affected/fixed versions could not be independently verified.

An authenticated administrator (or an attacker who has compromised an admin session) submits a crafted request to the /order/update/moneyInfo endpoint, triggering the flawed calculation in updateMoneyInfo so that order monetary fields (e.g., payment or freight amounts) are computed incorrectly. No public exploit code is known, and because the CVSS vector requires high privileges (PR:H) plus operator interaction (UI:P), realistic abuse is confined to a malicious or compromised admin.