waynboot-mall CVE-2026-110126

Requires a valid, authenticated member account on the waynboot-mall mobile API (PR:L) - exploitation is not possible by a fully unauthenticated attacker. No user interaction and no non-default configuration are needed: the AddressController lacks an ownership/authorization check in the default code path, and address IDs are auto-increment, making victim records trivially enumerable. Limiting factors that reduce real-world risk: the attacker must hold a registered member account, the impact is confined to modifying or deleting shipping-address records (no confidentiality breach or account takeover is described), and only deployments with multiple members present meaningful targets.

This is a medium-severity authorization flaw (IDOR, CWE-639) whose real-world risk is moderate but bounded. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L, score 5.3) is internally consistent with the description: exploitation is network-reachable and low-complexity via auto-increment ID enumeration, but requires an authenticated member account (PR:L), and impact is limited to integrity and availability of other members' shipping-address records with no confidentiality exposure (VC:N). No EPSS score, no CISA KEV listing, and no weaponized exploit code are present in the input, so there is no signal of active or widespread exploitation; the technique is, however, fully documented in the VulnCheck advisory and the HackMD write-up, which lowers the practical barrier to abuse. Weighing these signals together, this is a legitimate but second-tier priority: not a high-urgency internet-wide threat, but a trivially exploitable integrity issue for any deployment with multiple registered members. One conflict to verify: the input Tag labels this 'Authentication Bypass,' which contradicts both CWE-639 and the description (the attacker is already authenticated) - it is an authorization/ownership bypass, not authentication bypass.

An attacker registers or uses an existing member account on the waynboot-mall mobile app, then enumerates sequential (auto-increment) address IDs belonging to other members. Because AddressController performs no ownership check, the attacker sends POST /address or DELETE /address/{addressId} requests to overwrite or delete victims' saved shipping addresses - enabling checkout disruption or redirection of shipments. No weaponized exploit code was identified, but the VulnCheck advisory and HackMD write-up document the exact requests needed.