macrozheng mall CVE-2026-15186

Q: What is the CVSS score of CVE-2026-15186?

CVE-2026-15186 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-42585 LOW

Improper Control of Resource Identifiers ('Resource Injection') (CWE-99)

2026-07-09 VulDB

GHSA-3gfq-rr85-4p5x

Information Disclosure Mall

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-accessible IDOR requiring authenticated session (PR:L); low confidentiality and integrity impact on order records; no availability or scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 09, 2026 - 14:22 NVD

MEDIUM LOW

CVSS changed

Jul 09, 2026 - 14:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 09, 2026 - 13:55 vuln.today

DescriptionCVE.org

A vulnerability was identified in macrozheng mall up to 1.0.3. This impacts an unknown function of the file /returnApply/create of the component Portal Endpoint. The manipulation of the argument orderId leads to improper control of resource identifiers. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor deleted the GitHub issue for this vulnerability without any explanation.

AnalysisAI

Resource identifier manipulation in macrozheng mall up to 1.0.3 allows authenticated remote attackers to access or affect return-application records belonging to other users by substituting arbitrary orderId values in POST requests to /returnApply/create. The flaw is classified as CWE-99 (Improper Control of Resource Identifiers), consistent with an Insecure Direct Object Reference (IDOR) pattern in the Portal Endpoint. A public exploit is available, and the vendor deleted the corresponding GitHub issue without comment, raising concerns about coordinated disclosure and patch status.

Technical ContextAI

The affected component is the mall open-source Java e-commerce platform developed by macrozheng (cpe:2.3:a:macrozheng:mall:*:*:*:*:*:*:*:*), versions up to and including 1.0.3. The vulnerable endpoint /returnApply/create handles merchandise return requests and accepts an orderId parameter that is used to associate the return with a specific order. CWE-99 (Improper Control of Resource Identifiers) indicates the application fails to validate that the supplied orderId actually belongs to the authenticated user's session, enabling cross-account resource access. This is a classic IDOR (Insecure Direct Object Reference) implementation flaw in a Spring Boot-based REST API, where server-side authorization on the orderId field is absent or insufficient.

RemediationAI

No vendor-released patch has been identified at time of analysis - the GitHub issue was removed without a fix reference. Organizations running mall in any capacity should immediately restrict access to the /returnApply/create endpoint to only authenticated users whose session ownership is verified server-side. The specific fix requires adding an authorization check that confirms the submitted orderId belongs to the currently authenticated user before processing the return request; this should be implemented as a server-side guard in the return application service layer, not solely as front-end validation. As a compensating control, WAF rules can be deployed to flag or block requests to /returnApply/create where the orderId does not match a value previously associated with the authenticated session - though this requires session-aware WAF capabilities and is not foolproof. Monitor the project repository at https://github.com/macrozheng/mall/ for any future patch commits. Given the vendor's unresponsive disclosure behavior, consider forking and patching independently if the application is deployed.