macrozheng mall CVE-2026-15186

Exploitation requires a valid authenticated session on the mall portal (PR:L per CVSS 4.0) - unauthenticated access is not sufficient. The attacker must have the ability to enumerate or guess valid orderId values belonging to other users; sequential or predictable integer IDs (common in demo e-commerce platforms) would make this trivial. No special configuration is required beyond having a working mall instance with the return-apply feature active. Exploitation is limited to users with portal accounts and is bounded by the attacker's ability to identify valid foreign orderId values. There is no requirement for a specific OS, browser, or non-default feature flag - the vulnerability exists in the default return-application workflow.

The CVSS 4.0 base score of 5.3 (Medium) reflects a realistic assessment: network-accessible (AV:N), low complexity (AC:L), low privilege required (PR:L), no user interaction (UI:N), with low impact across confidentiality, integrity, and availability (VC:L/VI:L/VA:L). The E:P (Proof of Concept) exploitability supplement elevates practical risk above the base score alone. No CISA KEV listing is present, and EPSS data is not provided, making it impossible to quantify statistical exploitation probability. The vendor's deletion of the GitHub issue without explanation (reference: github.com/macrozheng/mall/issues/977) is a transparency red flag and suggests no official patch has been released. This is likely a medium real-world priority: the CVSS score aligns with impact, the exploit is public, but the product is primarily a demo/educational platform with limited enterprise production footprint, which constrains the blast radius.

An authenticated mall portal user with a valid session submits a POST request to /returnApply/create, replacing the orderId in the request body with the order identifier of another customer. Because the server does not verify orderId ownership, the return application is created or queried against the victim's order, potentially exposing order details (information disclosure) or submitting fraudulent return requests on the victim's behalf (integrity impact). A public proof-of-concept is available, lowering the skill threshold for exploitation.